[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3Lw9Aig2kJmVVBifZGGpehFQzJuM1lyzPC4Y0LTulok":3},{"article":4,"iocs":47},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":29,"category":30,"article_tags":34},"c39ac5a6-cc2b-4816-a8fd-29e8dd152023","New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution","new-wordpress-click2shell-flaw-forces-theme-installs-can-chain-to-code-execution-55eb40","WordPress today released patches to fix a new set of vulnerabilities in its core software, one of which could allow a crafted web link, opened by a logged-in administrator, to install a theme from the official WordPress.org directory without anyone clicking Install. The security firm pwn.ai, whose researchers reported the flaw, calls the attack chain Click2Shell. On its own the flaw only","WordPress has released version 7.1.1 to fix a critical vulnerability dubbed Click2Shell. This flaw allows an attacker to trick a logged-in administrator into installing a theme from the official WordPress.org directory by simply clicking a crafted web link. While the initial vulnerability only installs a theme, researchers demonstrated it can be chained with a separate theme flaw to achieve arbitrary code execution on the server.","WordPress patches Click2Shell flaw allowing theme installs via crafted links, chaining to code execution.","New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution Swati KhandelwalSep 18, 2026Vulnerability \u002F Web Security WordPress today released patches to fix a new set of vulnerabilities in its core software, one of which could allow a crafted web link, opened by a logged-in administrator, to install a theme from the official WordPress.org directory without anyone clicking Install. The security firm pwn.ai, whose researchers reported the flaw, calls the attack chain Click2Shell. On its own the flaw only installs a real theme that the attacker picks, but the security research team showed it could be combined with a separate weakness in a theme to run the attacker's own code on the server. The fix shipped on September 17 in WordPress 7.1.1. Because this is a security release, WordPress advises updating right away. There is no sign the flaw has been used in real attacks. The installed theme stays switched off, so the site's own appearance does not change and nothing looks wrong. Reaching code execution needed a second, separate flaw in the theme that was installed. As pwn.ai wrote of the core bug alone, \"The Core bug does not accept an arbitrary theme ZIP by itself.\" The flaw works because two parts of WordPress read the same link differently. The WordPress.org directory treats the value in the link as an ordinary theme name and returns a real theme, but the administrator's browser reuses the original text, punctuation and all, inside code meant to pick out an item on the page. Characters the attacker adds to the link send that code to the Install button, and WordPress's own script clicks it. Because the administrator is already logged in, their session supplies the permission and the security token the install needs, so the attacker supplies neither. An installed theme is not always idle. When WordPress builds a preview in its Customizer tool, it can load a theme's PHP code even before the theme is switched on. The theme pwn.ai used, Mobile Repair Zone, carried a second flaw: a background handler that fetched a web address from the request, downloaded a package, and ran its code, with no check on the visitor's permission or a security token. Chained after the forced install, that handler ran the attacker's code on the server. The researchers rated the forced-install flaw on its own as high severity, with a CVSS score of 7.1, and the full chain to code execution as critical, at 9.6. WordPress has not published a severity rating of its own, and in its release it described the issue this way: \"Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org.\" No CVE identifier has been assigned yet, though pwn.ai says WordPress plans to add one. WordPress fixed the flaw in 7.1.1, part of a security release whose fixes reach supported branches back to 4.7. Its notes confirm this flaw from version 6.0 up through the releases just before the fix. Site owners should install 7.1.1, or the matching update for whichever branch they run, and sites set to update automatically will receive it on their own. If you cannot update at once, note that neither WordPress nor pwn.ai offered a separate workaround, and that the attack still needs a logged-in administrator to open the attacker's link. Updating WordPress core closes the demonstrated attack whatever theme a site runs. Click2Shell is not the firm's first WordPress core flaw in recent weeks. In August, WordPress fixed a similar flaw pwn.ai found in the login screen and also chained to code execution, and there too WordPress described the risk more narrowly than the researchers did. A different WordPress core flaw disclosed in July, called wp2shell, is not connected to pwn.ai's work. That flaw needs no login and no click, and the U.S. cybersecurity agency CISA has listed it as exploited in real attacks, which Click2Shell has not been. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Vulnerability, Web Security, WordPress ⚡ Top Stories This Week OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure Claude Used to Automate Exploitation and Data Theft Across Multiple Victims Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6 Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days ChatGPT Flaw Let a Planted Prompt Send a Victim's Gmail Data to Another Account WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks When the Whole Company Adopts AI: What It Does to Your SOC Your Critical Vulnerabilities Might Not Be Your Biggest Risk What It Took to Reach 1 Billion Build Manifests US Becomes Top Target in RMM Phishing Campaign Spanning 46 Countries Why Are So Many Security Professionals Keeping Breaches Quiet? The Economics of Dwell Time and Why AI Native SIEM Changes the Equation ⭐ Featured Resources Get the eBook: Map Enterprise AI Risk Across the Full Lifecycle Give SOC Analysts Visibility Into 90% of Attacks Within 60 Seconds Benchmark Your SOC's AI Adoption With the 2026 Security Operations Report Register for LDR516: Strategic Vulnerability and Threat Management at SANS DC Metro","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fnew-wordpress-click2shell-flaw-forces.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjRmEdVvBEJZEaIzJ4GYHX3cDjJq5YaLQby6GeVwDl-uVl_qIR_tkRSx6aKpzoYhGVvp0E3NDIe9aum5f5N_lI-RPz6eDNGHC7vpKMa0UrlT1J1_bRJrJ8Wk0htpyFoR3ezoqh-BCJePJU914UFlL7gS45RXbWoVi3Lp49iNSkUt7eLrJyQTAEIGE-VRgY\u002Fs1600\u002Fclick2shell.gif","2026-09-18T16:56:19+00:00","2026-09-18T18:00:15.123767+00:00",8,[18,21,24,27],{"name":19,"type":20},"WordPress","product",{"name":22,"type":23},"pwn.ai","vendor",{"name":25,"type":26},"Click2Shell","campaign",{"name":28,"type":20},"Mobile Repair Zone","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":29,"icon":31,"name":32,"slug":33},null,"Vulnerabilities","vulnerabilities",[35,40,42],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":41},{"id":29,"icon":31,"name":32,"slug":33},{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[]]