WordPress Fixes Click2Shell Vulnerability That Can Force Theme Installation on Admin Accounts
September 19, 2026
WordPress has released a security update fixing multiple vulnerabilities in its core software, including a flaw that could allow an attacker to force a logged-in administrator to install and preview a theme from the official WordPress.org directory by simply opening a specially crafted web link.
The vulnerability, dubbed Click2Shell by security researchers at pwn.ai, can be used to automatically trigger the installation of a legitimate WordPress theme without requiring the administrator to manually click the Install button.
The vulnerability was fixed in WordPress 7.1.1, released on September 17, 2026. WordPress has classified the update as a security release and recommends that site administrators apply the update as soon as possible.
There is currently no indication that the vulnerability has been exploited in real-world attacks.
How the Click2Shell Attack Works
The vulnerability exists because two components of WordPress interpret a specially crafted URL differently.
When the attacker creates a malicious link, the WordPress.org theme directory interprets the supplied value as a normal theme name and returns a legitimate theme.
At the same time, the administrator's browser processes parts of the original URL inside JavaScript used by WordPress to identify elements on the page.
By carefully adding characters to the URL, an attacker can manipulate this process so that WordPress's own JavaScript identifies the Install button and triggers it automatically.
Because the victim is already logged in as an administrator, the browser's existing session provides the required authentication and security token.
The attacker therefore does not need to know the administrator's password or provide a separate authentication token.
The administrator only needs to open the specially crafted link.
The Installed Theme Remains Inactive
One important aspect of the vulnerability is that the maliciously selected theme does not automatically become the active theme.
The newly installed theme remains inactive, meaning the site's normal appearance does not necessarily change.
This can make the attack difficult to notice because the administrator may not immediately see any visible changes to the website.
However, WordPress can load PHP code from an inactive theme when generating a preview through functionality such as the Customizer.
This behavior can become significant when the installed theme contains another vulnerability.
Chaining the Core Flaw With a Vulnerable Theme
The researchers demonstrated that Click2Shell could be combined with a separate vulnerability in a WordPress theme to achieve server-side code execution.
For their demonstration, pwn.ai used a theme called Mobile Repair Zone.
The theme contained a background request handler that could retrieve a web address supplied through a request, download a package and execute its contents.
According to the researchers, the handler did not properly verify whether the requester had the necessary permissions or a valid security token.
This created a second-stage attack path.
First, the attacker forces the administrator's browser to install the vulnerable theme.
The attacker can then use the second vulnerability in the theme to execute their own code on the WordPress server.
The researchers rated the core vulnerability alone at 7.1 on the CVSS 3.1 scale and rated the demonstrated attack chain at 9.6.
WordPress itself has not published an equivalent severity score.
No CVE Assigned Yet
The vulnerability does not currently have a CVE identifier.
According to pwn.ai, WordPress plans to assign a CVE for the issue.
In its security release, WordPress described the vulnerability more narrowly as an issue where specially crafted URLs could automatically install and preview an inactive theme from WordPress.org.
The difference in description reflects the distinction between the core vulnerability and the complete attack chain demonstrated by the researchers.
The WordPress core issue itself does not allow an attacker to upload an arbitrary theme ZIP file.
Instead, the vulnerable functionality can be abused to force installation of a theme available through the official WordPress.org directory.
Achieving arbitrary code execution requires an additional vulnerability in the installed theme or another component.
Versions Affected
The vulnerability affects WordPress versions starting from 6.0 through the releases immediately before the security fix.
WordPress 7.1.1 includes the security fix, while corresponding security updates have also been issued for supported WordPress branches.
Site owners should update to WordPress 7.1.1 or the appropriate security release for their installed branch.
Websites configured for automatic WordPress updates should receive the security release automatically, but administrators should still verify that the update has been successfully installed.
What WordPress Administrators Should Do
Administrators should prioritize the following actions:
- Update WordPress core immediately to version 7.1.1 or the applicable fixed release for the site's branch.
- Verify the installed WordPress version after the update.
- Review installed themes and plugins and remove components that are no longer required.
- Update all third-party themes and plugins to their latest secure versions.
- Monitor administrator accounts for suspicious activity and unexpected changes.
- Review newly installed themes if the website was running a vulnerable WordPress version.
- Treat unexpected links opened while logged in as an administrator with caution.
WordPress and pwn.ai have not provided a separate workaround that replaces the core update.
If administrators cannot immediately update, the demonstrated attack still requires a logged-in administrator to open the attacker's specially crafted link. However, updating WordPress core is the recommended way to close the demonstrated attack path.
Click2Shell Follows Other WordPress Security Issues
Click2Shell is the latest in a series of WordPress security issues disclosed in recent months.
In August 2026, WordPress fixed another vulnerability reported by pwn.ai involving the login screen. Researchers demonstrated how that issue could also be combined with another vulnerability to achieve code execution.
A separate vulnerability disclosed in July 2026, known as wp2shell, is unrelated to the Click2Shell research.
Unlike Click2Shell, wp2shell does not require the victim to be logged in or to click a malicious link. The U.S. Cybersecurity and Infrastructure Security Agency has listed that vulnerability as having been exploited in real-world attacks.
Click2Shell currently has no reported evidence of real-world exploitation.
Security Update Recommended
The Click2Shell vulnerability demonstrates how seemingly limited browser-side behavior can become more serious when combined with an authenticated administrator session and a vulnerable WordPress component.
The core vulnerability does not independently provide an attacker with arbitrary code execution. However, when combined with a vulnerable theme, researchers demonstrated a path from a specially crafted link to code execution on the server.
WordPress administrators should therefore prioritize applying the latest security release and keep themes and plugins fully updated.
Organizations running WordPress should verify their installations and ensure that WordPress 7.1.1 or the appropriate fixed security release has been deployed.
