WordPress has patched a serious vulnerability in its core software—one that enables a malicious link, when opened by a logged-in administrator, to force-install a theme from WordPress.org without the admin clicking “Install.” This defect, dubbed Click2Shell, was uncovered by the security firm pwn.ai, which also showed how combining this issue with another flaw in a theme can lead to full code execution on the server.
What the Flaw Does—and How It’s Exploited
The flaw triggers when a crafted URL is clicked by a WordPress administrator. WordPress.org treats the manipulated value in the URL as a legitimate theme name, returning a real theme. At the same time, the administrator’s browser interprets parts of the URL inside code managing page elements. Attackers exploit that behavior to programmatically invoke the Install button—WordPress’s own script effectively clicks it for them. Since the admin is already logged in, session credentials and security tokens required for theme installation are automatically satisfied by WordPress.
On its own, this forced-install vulnerability doesn’t allow arbitrary code execution—it simply installs an inactive, real theme. But researchers showed a full attack chain: after installing a specific theme—one containing its own vulnerability—a background handler within the theme fetched remote content and executed it without validating permissions or tokens. In the test case, the Mobile Repair Zone theme was used to trigger code execution in this way.
Severity, Affected Versions, and the Fix
With the forced theme install considered a high-severity bug (CVSS 7.1) and the full chain to server-side code execution given a critical rating (CVSS 9.6), WordPress dropped a security release on September 17, 2026. Version 7.1.1 (and corresponding updates for all supported branches back to 4.7) resolves the issue.
WordPress notes that any version from 6.0 up through the release just before 7.1.1 is vulnerable. Site owners are urged to update to 7.1.1 (or their relevant branch’s update) immediately. The company and researchers did not provide a standalone workaround. Importantly, the threat depends on a logged-in administrator clicking the malicious link—so sites where admins frequently access dubious URLs are at higher risk.
This isn’t the first major flaw pwn.ai discovered recently. In August, they found a vulnerability in WordPress’s login screen that could be leveraged like Click2Shell, chaining into code execution as well. A separate flaw called wp2shell, disclosed in July, is unrelated but more dangerous—requiring no login or click and reportedly exploited in the wild by multiple attackers.
Mitigation and Best Practices
Updating WordPress core to 7.1.1 (or applying the corresponding patch for your version branch) is the only reliable fix. Automatic updates will handle this for sites with that setting enabled. Since the attack hinges on a real administrator clicking a manipulated link, limiting admin exposure to untrusted links—especially in email or from unfamiliar sources—helps reduce risk. Also, scrutinize themes for any background processes fetching external resources without authorization, and remove or replace vulnerable themes.
What this means: Click2Shell exposes how even seemingly minor theme installation logic can be weaponized when combined with weaker theme security. For WordPress, the implications are clear: site maintainers must keep core versions current and avoid using themes with uncertain provenance. We’ll be watching how the security community responds with tools to detect theme-based handlers, and whether more undiscovered chains exist that exploit similar quirks in install or preview mechanisms.
