"The Core bug does not accept an arbitrary theme ZIP by itself," wrote the security researchers at pwn.ai — a careful caveat hiding a simple, high-impact trick: a crafted link clicked by a logged-in administrator could silently install a theme from WordPress.org and, when paired with a vulnerable theme, hand an attacker code execution on the server.
Click2Shell: the vulnerability and how it works
Security firm pwn.ai named the issue Click2Shell. The vulnerability arises because two parts of WordPress interpret the same web link differently. The WordPress.org directory treats the value in the link as an ordinary theme name and returns a legitimate theme. The administrator’s browser, however, reuses the original text — including added punctuation and characters — inside client-side code that is meant to select an item on the page. Characters the attacker appends to the link can steer that client-side code to the Install button, and WordPress’s own script effectively clicks it.
Because the administrator opening the link is already logged in, their session provides the permission and security token required for the install; the attacker does not need to supply credentials or a token. The installed theme remains inactive, so the site’s appearance does not change and there is no obvious sign on the front end that anything happened.
From forced install to remote code execution: Mobile Repair Zone example
On its own, pwn.ai emphasized, the WordPress core flaw only forces the install of an available theme; it “does not accept an arbitrary theme ZIP by itself.” But the team demonstrated a full chain to code execution by combining Click2Shell with a separate flaw in a theme they chose, Mobile Repair Zone.
That theme contained a background handler that took a web address from the request, downloaded a package from that address and executed its code without checking the visitor’s permission or a security token. Chained after the forced install, the handler ran the attacker’s code on the server. The researchers rated the forced-install element as high severity (CVSS 7.1) and the chained code execution as critical (CVSS 9.6).
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramblePatch, versions affected and mitigation guidance from WordPress
WordPress shipped a fix on September 17 in version 7.1.1 and included the correction in its security release that reaches supported branches back to 4.7. The project's release notes confirm the flaw exists from version 6.0 up through the releases immediately before the fix. WordPress described the issue this way: "Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org."
WordPress advises updating immediately because this is a security release. Sites set to update automatically will receive the patch on their own. Neither WordPress nor pwn.ai published an alternate workaround, and pwn.ai noted that the attack still requires a logged-in administrator to open the malicious link. Updating WordPress core closes the demonstrated attack regardless of which theme a site runs.
Severity ratings, CVE status, and how this fits recent disclosures
pwn.ai assigned CVSS scores of 7.1 for the forced-install core bug and 9.6 for the complete chain to code execution. As of the report, no CVE identifier had been published; pwn.ai said WordPress plans to add one. The researchers pointed out this is not an isolated finding: in August, pwn.ai reported a similar WordPress core flaw in the login screen that was also chained to code execution, and July’s separate wp2shell disclosure — not connected to pwn.ai’s work — required no login and no click and has been listed by CISA as exploited in the wild. Click2Shell, by contrast, shows no sign of having been used in real attacks so far.
What this means for site owners, security teams, and administrators
- Site owners and administrators: install WordPress 7.1.1 or the matching update for your branch as soon as practical. Automatic updates will push the fix to sites that use them.
- Security teams and incident responders: check administrator activity and look for evidence that an otherwise-inactive theme was installed without a corresponding theme activation or UI change; note that WordPress’s Customizer can load theme PHP code while a theme is still inactive, which is how some chained exploits execute code before a site’s visible theme changes.
- Developers and theme maintainers: audit theme code for unsafe background handlers that download and execute code based on request parameters without permission checks or security tokens; such handlers are the component that enabled the full chain demonstrated by pwn.ai.
WordPress fixed the technical vector in core on September 17, but the full risk depends on combinations: a forced install plus a vulnerable theme handler. The immediate, concrete step is clear and narrow — update core to 7.1.1 (or the branch-matching patch) — and doing so severs the chain at its first link. Beyond that, the episode underscores a recurring pattern in the record: small divergences in how components parse input can be harmless on their own and disastrous when concatenated with insecure third-party code.
https://thehackernews.com/2026/09/new-wordpress-click2shell-flaw-forces.html
