# Critical Click2Shell Vulnerability in WordPress Demands Immediate Update

*Published September 21, 2026*
*Source: [https://cybersecuritynews.com/click2shell-wordpress-vulnerability/](https://cybersecuritynews.com/click2shell-wordpress-vulnerability/)*

## Executive Summary

*This is a Premium edition. The Executive Summary is available to sec-news.ai members —*
*[read it here](https://www.sec-news.ai/news/critical-click2shell-vulnerability-in-wordpress-demands-immediate-update) or [see plans](https://www.sec-news.ai/pricing).*

## Article

WordPress administrators are advised to update their systems promptly following the disclosure of a critical vulnerability known as Click2Shell. This exploit chain allows attackers to convert a single malicious link into remote code execution on susceptible websites. The vulnerability exploits a weakness in the WordPress Core theme-preview feature, which can silently install a theme chosen by an attacker from the official directory. This flaw can lead to a server compromise when combined with insecure pre-activation code in a theme.

The issue was addressed in WordPress version 7.1.1, released on September 17, 2026. This update included 11 security fixes, 17 Core bug fixes, and 19 Block Editor fixes. The official advisory credits researchers Paulos Yibelo and pwn.ai for identifying the issue. It highlights that specially crafted URLs can automatically install and preview an inactive theme from WordPress.org. For the attack to be successful, a logged-in administrator must visit the malicious URL, allowing the attacker's code to execute using the administrator's authenticated session.

The vulnerability stems from inconsistent processing of a theme value in the theme installer route. While WordPress.org’s Themes API canonicalizes the input, the administrator's browser retains the original punctuation, which can be exploited through jQuery selectors. Although this alone does not allow for immediate remote code execution, it sets the stage for further exploitation.

The complete exploit chain was demonstrated using Mobile Repair Zone version 2.5.4. During a Customizer preview, the inactive theme's PHP exposed an authenticated AJAX handler lacking proper nonce and capability checks. This allowed attackers to execute code under the web server's account by supplying attacker-controlled plugin details and a package URL.

The potential impact of a successful compromise includes access to wp-config.php, database credentials, WordPress or WooCommerce data, and the ability to alter files, create users, and steal secrets available to the PHP worker. WordPress has fixed the vulnerability by restricting matching to a genuine div.theme card and using jQuery’s escapeSelector() to handle the URL-derived slug securely.

Pwn.ai assessed the forced-install issue as High severity with a CVSS score of 7.1, while the full remote code execution chain was considered Critical. No evidence of exploitation in the wild has been reported. Site owners are urged to install WordPress 7.1.1 or apply the relevant security release for their branch immediately. Administrators should enable automatic updates, review themes and plugins, and inspect unexpected changes or requests.