A critical vulnerability dubbed “Click2Shell” allows attackers to trigger remote code execution (RCE) on WordPress sites using nothing more than a specially crafted link. WordPress admins are being advised to upgrade immediately after researchers revealed how this exploit chain works by leveraging a theme-preview flaw in the core and combining it with insecure theme pre-activation code. The issue was addressed in WordPress 7.1.1, released September 17, 2026.
How Click2Shell Works
The exploit starts with a weakness in the WordPress Core’s theme-preview functionality. Attackers can use specially formed URLs to silently install an inactive theme from WordPress.org without immediate activation or visible change to the site’s appearance. Because the theme remains inactive initially, the malicious action is stealthy.
The vulnerability arises from how the theme installer handles theme identifiers. WordPress’s Themes API cleans up user input to generate a standard catalog slug, but the admin’s browser still uses original input in a jQuery selector. That mismatch allows attackers to escape expected input boundaries, target the Install control in the theme card, and initiate installation programmatically.
On its own, this behavior doesn’t allow RCE. But the researchers demonstrated that it becomes dangerous when paired with a vulnerable theme. In their proof-of-concept, a theme’s Customizer preview process exposed an AJAX handler that lacked proper permission and nonce checks. This handler accepted attacker-controlled archive URLs, then downloaded, unpacked, and executed PHP code within the archive—leading to full server compromise.
Impact, Severity, and Fixes
A successful Click2Shell attack lets malicious actors access sensitive files like wp-config.php, read database credentials, modify or upload files, create new accounts, steal secrets accessible to PHP processes, and potentially escalate access within the hosting environment.
The WordPress team patched the root selector vulnerability in changset 63664. Fixes include limiting selector matching to actual theme card elements and using jQuery’s escapeSelector so that harmful characters are treated as literal slug content rather than executable CSS selector syntax.
The broader threat was assessed with mixed severity: the forced-install primitive earned a CVSS 3.1 rating of 7.1 (High), while the full chain to RCE is deemed Critical. As of disclosure, no CVE identifier was published, and there were no reports of this being exploited in active attacks.
What Site Owners Must Do Now
Sites running WordPress should upgrade to version 7.1.1 or apply patches backported to all supported branches. The fixes have been applied to versions as far back as 4.7, but only version 7.1.1 is fully supported for updates.
Admins should also verify automatic update settings, audit recent theme and plugin installations, check for unexpected PHP files or user accounts, and monitor for suspicious requests to endpoints like theme-install.php or admin-ajax.php enabled with Customizer features.
This vulnerability was reported on August 22 when core theme-preview issues were first disclosed. The full pre-activation exploit chain was shared on September 1. The patch landing in 7.1.1 came on September 17, with technical write-ups becoming public right after.
Click2Shell highlights a growing trend of chained vulnerabilities turning seemingly minor misconfigurations into full server breaches. It’s a reminder that complex interactions—between core components and third-party themes—are an increasingly common attack vector. Any delay in patching not only risks data exposure but also broader system takeover. Moving forward, the industry needs stronger auditing around theme and plugin activation paths, tighter input validation in UI components like theme cards, and a more proactive disclosure and response process. What to watch now: whether evidence of malicious exploitation appears in the wild, how quickly hosting providers detect and remediate vulnerable installations, and how WordPress’s future updates strengthen theme/pre-activation isolation.
