ATTENTION! Click2Shell can lead to remote code execution through a malicious link!
Attention WordPress administrators! Experts have identified an attack chain that allows an attacker to force an administrator to visit a single specially crafted malicious link and subsequently execute malicious code on the site.
This attack method, named Click2Shell, exploits a vulnerability in the WordPress core to allow remote code execution. While the vulnerability does not directly lead to remote code execution, when combined with security weaknesses in certain website themes, it can turn into an attack chain that allows the attacker to execute their PHP code on the server.
The issue was fixed in the WordPress 7.1.1 security update released on September 17, 2026. This version resolves 11 security fixes, 17 WordPress core bugs, and 19 Block Editor errors. WordPress recommends that users install this security update as soon as possible.
What is Click2Shell?
Click2Shell is an attack chain that exploits a vulnerability in the WordPress core during the process of automatically installing and previewing themes, combining it with another security issue to lead to remote code execution (RCE).
According to researchers' findings, the attacker sends a specially crafted link to the administrator. When the administrator opens this link while logged into the WordPress system, the theme installation process can be initiated through trusted JavaScript functions present in WordPress.
The important point is that the attacker does not necessarily need to have administrator credentials. However, for the attack chain to work, the administrator must visit the malicious link. Therefore, methods such as social engineering, phishing, and fake service notifications can play an important role in this attack.
How is the attack carried out?
The Click2Shell attack can be divided into several stages:
1. A malicious link is sent to the administrator.
The attacker sends a specially formatted URL to the WordPress administrator. The link may appear as a simple or trustworthy address from an external perspective.
When the administrator opens this link, the mechanism for previewing themes in WordPress is activated.
2. The administrator is forced to install an unexpected theme.
This vulnerability is related to an inconsistency in how data is processed in the WordPress theme catalog.
The system, on one hand, adjusts the sent value to the actual theme name in the WordPress.org themes catalog. On the other hand, this value is inserted into the jQuery selector structure in the administrator's browser.
Using specially crafted characters, the attacker can modify the logic of this selector to reach the actual "Install" button on the WordPress page.
As a result, the theme selected from the WordPress.org catalog is installed without the administrator's awareness.
3. The installed theme may not be immediately activated.
This stage does not necessarily imply full server takeover.
The installed theme is taken from the WordPress.org catalog and may remain in an inactive state initially. Therefore, there is a possibility that there will be no noticeable change in the website's appearance.
This situation makes it difficult to detect the attack.
4. A second vulnerability escalates the attack to RCE level.
Researchers demonstrated the attack chain in the context of the Mobile Repair Zone 2.5.4 theme.
It was found that security checks were not sufficiently performed in the code before the activation of this theme, specifically lacking checks for the relevant nonce and user permissions.
As a result, the attacker can deliver information they control, including plugin details and package addresses, to the server, establishing a chain that allows downloading, opening, and executing PHP code.
In this way, the seemingly simple process of "malicious link → theme installation" can ultimately turn into a dangerous attack chain:
malicious link → theme installation → vulnerable theme code → PHP code execution → Remote Code Execution (RCE)
which can appear as a dangerous attack chain.
What danger arises when RCE occurs?
If the attacker can execute their PHP code on the server, the consequences of the attack are not limited to just modifying the WordPress theme.
Depending on the level of privileges on the server, the attacker can:
access information in files like wp-config.php; input database connection details; steal WordPress user and other information; modify site files or place new malicious files; create new administrator accounts; take over existing user accounts; input confidential keys and other server environment information; modify the site content or place malicious code; and in some cases, continue the attack to other parts of the server or hosting environment where WordPress is located.
Therefore, Click2Shell should be viewed not just as a technical issue related to WordPress theme installation, but as an attack chain that can affect the security of the web infrastructure.
How does WordPress fix the vulnerability?
WordPress developers fixed the issue via changeset number 63664.
In the update, a mechanism was implemented to safely reprocess specially formatted characters before they are inserted into the jQuery selector. Additionally, the search was limited to elements relevant to the actual WordPress theme directory.
As a result, specially formatted characters such as quotes, combinators, or comments sent by the attacker are not interpreted as CSS/jQuery selector syntax but are reprocessed as the corresponding values.
This fix was included in the WordPress 7.1.1 version.
According to official WordPress information, this issue was reported by Paulos Yibelo and pwn.ai. In version 7.1.1, a separate CVE identifier for this issue was not announced at that time.
Risk Level of the Vulnerability
pwn.ai researchers rated the independent mandatory theme installation issue in the WordPress core as High according to CVSS 3.1 for version 7.1.
The full RCE attack chain was rated Critical by the researchers. However, the final official risk level from WordPress was not announced at that time.
Furthermore, researchers presented a technical analysis on September 18, 2026. According to their information, WordPress was notified about the vulnerability on August 22, and the full attack chain was presented on September 1. WordPress released the fix on September 17.
Which WordPress versions should be paid attention to?
Researchers indicated that Click2Shell can affect WordPress versions prior to 7.1.1. WordPress is aware that security fixes are also being applied to relevant older, supported networks. According to official information, security fixes are being backported to supported networks up to version 4.7.
As of September 17, 2026, the following security updates are included in the series:
- WordPress 7.1.1;
- WordPress 7.0.5;
- WordPress 6.9.8 and relevant security updates;
- backports released for other older supported networks.
The WordPress official releases page indicates version 7.1.1 as the latest 7.1 branch.
What should organizations pay attention to?
Administrators of government agencies, corporations, educational institutions, and other organizations operating on WordPress are advised to take the following measures:
1. Update the WordPress core promptly.
The system must be updated to the relevant security version as quickly as possible. The official security release for WordPress 7.1.1 has been released.
2. Check for automatic updates.
It is mentioned that the update process can be automatically initiated for websites that support automatic updates. Nevertheless, administrators should manually check the current version for appropriate purposes.
3. Inventory installed themes and plugins.
Check for themes and plugins that have been installed or activated unexpectedly in recent days. Administrators should pay special attention to components not installed by them.
4. Check PHP files.
Identify any unknown PHP files recently created or modified on the web server. In particular, unexpected PHP files appearing in WordPress directories should be checked as potential signs of compromise.
5. Monitor administrator accounts.
Check newly created administrator accounts, changed passwords, unexpected permissions, and suspicious authentication statuses.
6. Analyze web server and WordPress logs.
Analyze suspicious requests, unusual actions related to theme installation, and unexpected requests sent via Customizer and admin-ajax.php.
7. Check not only the WordPress core but also third-party components.
The danger of the Click2Shell attack chain is also related to security vulnerabilities in themes or other components alongside the issue in the WordPress core. Therefore, it is necessary to update all themes and plugins, and remove unknown or unsupported components from the system.
Important Warning for Administrators
In this attack, the act of the administrator opening the malicious link is considered an important factor. Therefore, WordPress administrators should be cautious when opening unknown links containing content such as "quick update," "issue found on the site," "verify your account," "view the theme," etc., received via email, messengers, or other communication channels.
The risk of opening unknown links is even higher if the administrator is already logged into the system.
Click2Shell presents a broader risk than a single technical vulnerability in WordPress. It combines the issue in the theme installation mechanism in the WordPress core with a security weakness in a third-party component, potentially leading to remote code execution on the server after the administrator visits a single malicious link.
WordPress resolved this issue with the 7.1.1 security update released on September 17, 2026. Therefore, administrators of information systems and web resources based on WordPress should review their systems' current versions, install security updates, and review recent changes to themes, plugins, users, and files.
Important: The open investigations regarding Click2Shell indicate that the attack chain requires the administrator to visit a malicious link. Therefore, this information does not imply that all WordPress sites are compromised. However, if there are unpatched systems or suspicious changes, they must be checked without delay.