AI-generated editorial illustration; not a documentary photograph.
WordPress released version 7.1.1 with fixes for 11 vulnerabilities, including Click2Shell, a flaw that could enable remote code execution after a logged-in administrator visits a specially crafted URL. The issue does not yet have a CVE identifier, according to SecurityWeek's September 22, 2026 report.
A Click Can Install a Theme
Click2Shell can make WordPress automatically install and preview an attacker-selected inactive theme from the official WordPress.org catalog. The attack does not require the attacker to have a WordPress account, but it does depend on a logged-in user visiting the malicious URL.
Security firm pwn.ai, which discovered and reported the vulnerability, traced it to inconsistent handling of a value in the theme-preview URL. The themes API reduces that value to a normal theme slug, while browser-side JavaScript retains punctuation and inserts the result into a jQuery selector.
Inactive Themes Can Still Execute PHP
Installing an inactive theme would ordinarily appear to have limited impact. However, pwn.ai identified more than 40 third-party WordPress themes whose PHP code could be abused while the themes remain inactive. WordPress loads that code during a Customizer preview even when another theme is still active.
According to pwn.ai, vulnerable installers in those themes could be directed to a crafted plugin package, leading to code execution under the WordPress server account. Because the site's primary theme remains active, administrators may not immediately notice the installation or preview activity. The security firm has published technical details and proof-of-concept code.
Fixes Extend to Older Releases
WordPress addressed Click2Shell alongside 10 other vulnerabilities in version 7.1.1. Corresponding security updates were also issued for older WordPress branches extending back to version 4.7, giving operators of legacy installations a patched release path.
WordPress credited pwn.ai for the report and paid a $300 reward, described by SecurityWeek as the project's maximum bug bounty. Site operators should prioritize the applicable security update because exploitation can begin with a single administrator visit and may not visibly change the site's active theme.
Source: WordPress Patches ‘Click2Shell’ Vulnerability
SIGNAL TITANS
Leave a Reply