Click2Shell runs attacker PHP on WordPress servers after a single administrator click
Paulos Yibelo of pwn.ai reported the Core flaw on August 22 and WordPress fixed it in 7.1.1 last week. The full proof-of-concept is now public, and the chain needs no attacker account, only an administrator who opens a link.
The Watch · Security desk
What happened
- Click2Shell is a pre-authenticated remote code execution chain in WordPress Core that installs any theme from the official WordPress.org catalog and runs an arbitrary PHP file on the server.
- Paulos Yibelo of the autonomous penetration testing platform pwn.ai found the flaw and reported it to WordPress on August 22.
- The attacker does not authenticate, but the exploit only fires when a logged-in administrator visits the crafted URL, which is the single precondition on the victim side.
Why it matters
- Who's exposed exposure Any site still on 7.1.0 or earlier is reachable through its administrators' inboxes, and the attacker needs nothing on the target to start.
- What's now possible capability An admin-facing XSS bug in any plugin or theme becomes a server-side code execution path on unpatched Core, because the administrator's browser sends the request without a click.
- Who has to decide decision Operators who cannot upgrade this week have one named blocker, DISALLOW_FILE_MODS, and enabling it is a configuration change that has to be in place before the phishing mail arrives.
- What doesn't add up contradiction The pre-authenticated label describes the attacker's requirements; the trigger still sits in an authenticated administrator's browser, so a site with two careful admins is a harder target than the label implies.
Next story · Security · 4d ago
Bricksforge's unauthenticated upload flaw is being used to run PHP on WordPress sitesConfirmed3 publishers
The chain turns on one value read twice. pwn.ai's researchers wrote that "a value from a WordPress theme-preview URL is interpreted once by the WordPress.org Themes API and a second, buggy methods by JavaScript in the Administrator's browser" [6]. The result is a theme added to the target site without the administrator choosing to install it [7]. The second stage does not need activation: an inactive theme still executes PHP while the Customizer builds a preview [8].
WordPress closed it in 7.1.1 by escaping the theme slug before using it in the jQuery selector, and by restricting that selector to actual theme cards [16]. The defect sat in the dashboard's own JavaScript [20].
The attacker works the chain without an account, an installation nonce, or privileges of their own [10]. The chain needs an administrator with a live session who opens the crafted URL [9]. Patchstack, which analysed the flaw, says Author and Editor accounts cannot trigger it because they lack permission to install themes [17], and warns the request can equally be produced by targeted phishing or by an existing XSS flaw that makes the administrator's browser send it [18].
Once PHP runs, the reachable set includes file modification and deletion, user data, and wp-config.php with its database credentials and authentication secrets [13]. From there come rogue admin accounts and injected scripts [14]. The Core defect is in 7.1.0 and earlier [15], so every install not running 7.1.1 is in scope [21].
pwn.ai demonstrated the chain using one vulnerable theme from the catalog as the second component [11], and the report says the Core flaw could be used to force-install any other vulnerable theme in that catalog [15]. Version 7.1.1 blocks the forced install, and it does not change the themes themselves, which an administrator can still install by hand [22]. For sites that cannot upgrade at once, Patchstack says a site with DISALLOW_FILE_MODS enabled cannot be forced into installing the theme or a malicious plugin [19].
Yibelo reported the flaw on August 22 [5]. The fix shipped last week, and the issue has no official identifier [1][3]. Technical details and a working exploit are public [2], so the usual gap between a patch and usable exploit code is already gone. The published report carries a complete proof-of-concept for server-side remote code execution [12].
What to watch
- Whether an official identifier is assigned, since scanners and patch-compliance tooling key on one.
- Whether the vulnerable catalog theme used as the second stage, and others like it, are patched or pulled from WordPress.org.
- First reports of the chain fired against live admin sessions, and whether delivery is phishing or stored XSS in a plugin.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+10
- Incentives40
- Confidence70
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The flaw was addressed last week with the release of WordPress version 7.1.1.
- [2]
Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery vulnerability dubbed 'Click2Shell' that affects the platform's Core component.
- [3]
The Click2Shell security problem does not have an official identifier.
- [4]
Click2Shell is a pre-authenticated remote code execution chain that allows an attacker to install any theme in the official WordPress.org catalog and run an arbitrary PHP file.
- [5]
Security researcher Paulos Yibelo of the autonomous penetration testing platform pwn.ai discovered Click2Shell and reported it to WordPress on August 22.
- [6]
The researchers explain that "a value from a WordPress theme-preview URL is interpreted once by the WordPress.org Themes API and a second, buggy methods by JavaScript in the Administrator's browser."
- [7]
The flaw enables an attacker to add a WordPress theme to a target website without the administrator explicitly installing it.
- [8]
Even if inactive, a theme could still execute PHP during a Customizer preview.
- [9]
Even though the attacker does not need to authenticate, a logged-in administrator needs to visit a crafted URL for the Click2Shell exploit to work.
- [10]
The researcher notes that an attacker does not need a WordPress account, an installation nonce, or their own administrative privileges.
- [11]
To demonstrate the issue, pwn.ai used a vulnerable WordPress theme as the second component in the chain that executed the attacker's PHP code.
- [12]
The researcher's full technical report provides a complete proof-of-concept exploit for achieving server-side remote code execution.
- [13]
Executing code this way could enable file modification and deletion, access to user data, and access to the 'wp-config.php' file that contains database credentials and authentication secrets.
- [14]
An attacker could leverage this access to create rogue admin accounts or inject malicious scripts.
- [15]
The underlying flaw in WordPress Core 7.1.0 and earlier could be leveraged to force-install any other vulnerable theme in the WordPress catalog.
- [16]
WordPress fixed the Core vulnerability in version 7.1.1 by escaping the theme slug before using it in the jQuery selector and restricting the selector to actual theme cards.
- [17]
WordPress security firm Patchstack analyzed Click2Shell and highlights that only an administrator can trigger the chain, while Author and Editor accounts lack the required permission to install themes.
- [18]
Patchstack warned that attacks are possible via targeted phishing or an existing cross-site scripting flaw that makes the administrator's browser send the request.
- [19]
Patchstack says websites with 'DISALLOW_FILE_MODS' enabled cannot be forced to install the theme or a malicious plugin.
- [20]
The patched code path is admin-side JavaScript: the slug was used unescaped in a jQuery selector in the administrator's browser.
- [21]
Because the defect is present in Core 7.1.0 and earlier and fixed in 7.1.1, every WordPress install not running 7.1.1 is exposed.
- [22]
Version 7.1.1 removes the forced-install step, and it does not alter the vulnerable catalog themes, which an administrator can still install deliberately.
Sources
2 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comWordPress Click2Shell flaw lets hackers execute PHP on the server
1 article · September 21, 2026
- securityweek.comWordPress Patches ‘Click2Shell’ Vulnerability
1 article · September 22, 2026