WordPress Patches Click2Shell Flaw That Let One Clicked Link Install a Theme and Chain to a Full Server Takeover

WordPress released version 7.1.1 on September 17, bundling 11 security fixes into what the platform calls a maintenance and security release. One of those fixes closes a hole that security research firm pwn.ai discovered and reported, naming the flaw Click2Shell.

The core bug: a specially crafted link, opened by an administrator who is already logged into a WordPress dashboard, can trigger an unwanted theme installation with zero clicks beyond opening the URL. No password re-entry, no Install button, no visible warning. WordPress's own release notes describe it plainly: "Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org."

How the chain actually works

pwn.ai laid out the mechanics in its own writeup. WordPress's theme-preview page reads a URL parameter to figure out which theme to load. Two different systems interpret that same parameter two different ways.

The WordPress.org Themes API treats the value as an ordinary theme slug and hands back a real, catalog-listed theme. Meanwhile, the administrator's browser reuses the original text, including punctuation, inside a jQuery selector meant to find something on the page. An attacker who stuffs extra characters into that parameter can steer the selector straight to the Install button, and WordPress's own JavaScript clicks it automatically.

Because the administrator is already authenticated, their session supplies the permission and security token the install needs. The attacker supplies neither.

That alone just installs a real, inactive theme, which is not obviously dangerous, according to The Hacker News' reporting on pwn.ai's findings. But WordPress's Customizer tool, built for live theme previews, can load a theme's PHP code, including its functions.php file, before that theme is ever activated. Nothing on the site visibly changes. The only trace is an unfamiliar theme sitting inactive in the site's library.

pwn.ai then tested whether an installed-but-inactive theme could go further. Using a real theme called Mobile Repair Zone, version 2.5.4, researchers found a background AJAX handler with no nonce or capability check, one that would fetch a URL, download a package, and run its code. Chained after the forced install, that handler let pwn.ai execute arbitrary PHP on the server after a single visit to an attacker-controlled page. pwn.ai says it found similar exploitable weaknesses in more than 40 other third-party themes hosted on WordPress.org.

Severity and patch status

pwn.ai rated the core forced-install bug alone as high severity, CVSS 7.1. The full chain to remote code execution scored critical, at 9.6. WordPress has not issued its own severity rating and, as of pwn.ai's disclosure, had not yet assigned a CVE identifier, though pwn.ai says WordPress told them one is coming and confirmed paying its maximum bug bounty payout for the find.

The fix landed in 7.1.1, with patches extending back through supported branches to version 4.7. WordPress's release notes confirm the vulnerable window ran from version 6.0 through the releases immediately before the September 17 patch. Sites configured for automatic core updates should already have received the fix. Everyone else needs to update manually.

The Hacker News, citing WordPress's own advisory, reports there is no sign the flaw has been exploited in real attacks. Tech Times reports that working exploit code hit GitHub on September 18, the day after the patch shipped, which it characterizes as collapsing the effective patching window to hours for sites that hadn't yet updated. None of the other sources in this reporting corroborate that specific claim about public exploit code, so it stands on Tech Times' account alone.

What site owners actually need to do

The practical guidance is straightforward: update WordPress core to 7.1.1 or the matching patched release for an older branch, immediately. pghnetworks, writing for small business owners, flagged a real-world wrinkle that matters more than the exploit's technical elegance. Plenty of small firms have WordPress sites built years ago by an outside agency and handed off, with nobody currently certain who holds admin credentials. The attack requires an admin to open a malicious link, and in a small office that admin is often a marketing coordinator or office manager who has never sat through a WordPress-specific phishing drill.

TechJuice noted a broader industry pattern this reflects, pointing to a separate, unrelated critical exploit chain in the Avada theme, rated CVSS 9.8, as another 2026 example of individually moderate flaws being chained into full compromises. Outdated plugins and themes remain the top cause of WordPress site breaches, according to TechJuice's reporting.

The open question now is simple: how many self-hosted sites, particularly the ones nobody at the company is actively watching, are still running an unpatched core version with the CVE identifier for Click2Shell still pending.