WordPress Click2Shell: One Admin Click Opens RCE on Millions of…

A CSRF vulnerability in WordPress core allows unauthenticated attackers to force a logged-in administrator to install an arbitrary theme from the official WordPress.org directory, leading to remote PHP code execution. Version 7.1.1 patches the flaw.

On September 17, 2026, WordPress released version 7.1.1, fixing a core vulnerability that lets an unauthenticated attacker force a logged-in administrator to install an arbitrary theme from the official WordPress.org catalog, paving the way for remote PHP code execution on the server. The flaw, dubbed Click2Shell by the pwn.ai researchers who discovered and disclosed it, exploits a discrepancy between server-side parsing and client-side interpretation that no one had previously mapped as an attack surface. With WordPress powering roughly 43% of the entire web, the stakes extend far beyond any single installation.

Key Takeaways

The root cause is a jQuery selector injection in the wp-admin theme preview screen: the URL parameter is canonicalized by WordPress.org APIs but preserved with its original punctuation in the JavaScript selector executed in the administrator's browser.
The full chain reaches maximum severity: CVSS 3.1 7.1 for the forced-install CSRF primitive alone, and CVSS 3.1 9.3–9.6 for the chained remote code execution with a vulnerable theme.
The theme installed via the attack remains inactive and invisible on the public site, yet WordPress still executes its functions.php during the Customizer preview, creating a hidden execution surface.
The fix, contained in changeset 63664, restricts matching to div.theme elements and applies escaping to the URL-derived slug before it enters jQuery selector syntax.

The Dual Parsing That Deceives WordPress and the Administrator

Paulos Yibelo of pwn.ai identified the fundamental mechanism in the admin panel's theme preview architecture. When an administrator visits a crafted URL, the theme parameter undergoes two incongruent treatments: on one side, the WordPress.org APIs normalize the slug by stripping special characters; on the other, the file wp-admin/js/theme.js inserts it directly into a jQuery selector while preserving the original punctuation.

This discrepancy allows injection of arbitrary selector syntax. The proof-of-concept payload, as reported in pwn.ai's technical write-up, uses the string twentytwenty"]>*>*>/* to break out of the original selector context and reach the action controls—specifically the Install button. The result, in the researchers' own words, is "a theme preview that clicks Install by itself." No conscious click by the administrator, no explicit confirmation.

WordPress has publicly acknowledged the nature of the flaw. In the version 7.1.1 release notes, as quoted by The Hacker News, it states: "Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org." The same source reports the explicit distinction made by the researchers: "The Core bug does not itself accept an arbitrary theme ZIP." The forced installation is limited to themes present in the official catalog.

"A value from a WordPress theme preview URL is interpreted once by the WordPress.org Themes APIs and a second time, with flawed methods, by JavaScript in the Administrator's browser." — Paulos Yibelo/pwn.ai, reported by BleepingComputer

The Customizer Preview as a Hidden Execution Engine

The critical link in the exploit chain lies in a core behavior long underestimated by security teams: WordPress loads a theme's PHP during the Customizer preview, even when the theme is still inactive and another theme remains active on the visible site. This means malicious code in functions.php—or in other included files—executes on the server without the theme ever being publicly activated.

The pwn.ai researchers demonstrated the full chain by exploiting the Mobile Repair Zone theme version 2.5.4, which contained an AJAX handler lacking nonce verification or user capability checks. The handler retrieved attacker-controlled plugin details, completing the escalation to arbitrary remote PHP code execution. The public site showed no changes: the theme stayed inactive, but the server was already compromised.

The stealthy nature of the attack makes detection particularly insidious. No visible changes, no suspicious active theme, no installation notification to draw attention. The only residual trace is the existence of an additional theme in the wp-content/themes directory, easily mistaken for a forgotten or test installation.

The Inactive Theme Blind Spot and the pwn.ai Discovery

The pwn.ai research uncovered a systemic dimension to the problem. Beyond the Mobile Repair Zone proof-of-concept, the researchers identified over 40 third-party themes in the WordPress.org catalog with similar pre-activation vulnerabilities: AJAX handlers, arbitrary inclusions, or code execution triggers that fire before the theme ever becomes active on the site. This broad sample confirms the attack surface is not limited to a single defective product but concerns a widespread architectural pattern.

The discovery was reported to WordPress on August 22, 2026. After nearly four weeks of handling, the fix was released on September 17, 2026 in version 7.1.1, which includes 11 security fixes overall. Changeset 63664, analyzed by both pwn.ai and CyberPress, implements two complementary countermeasures: constraining the preview matching to div.theme elements—thereby excluding selectors pointing to action controls—and applying $.escapeSelector() to the URL-derived slug before its insertion into jQuery selector syntax.

WordPress acknowledged the severity of the report by awarding the maximum bounty under its bug bounty program, as confirmed by the pwn.ai report. At the time of disclosure, no official CVE identifier had yet been assigned, though sources indicate WordPress intends to pursue assignment.

Immediate Actions

Update to WordPress 7.1.1 immediately: the September 17, 2026 release contains the definitive fix for all affected versions from 6.0 through 7.1.0 inclusive.
Review themes in wp-content/themes and remove unnecessary inactive ones: every inactive theme represents a potential execution surface during Customizer preview.
Ensure the DISALLOW_FILE_MODS constant is enabled in environments where dynamic theme or plugin installation is not required, as this configuration blocks the forced-install primitive.
Reprioritize patching: the usual focus on active themes alone is insufficient; security controls must extend to all installed themes, including dormant ones.

A Recalibration of Inactive Theme Risk

Click2Shell is not merely a new vulnerability to catalog and forget. It demonstrates that WordPress's Customizer architecture has effectively created a PHP execution free zone separate from the theme activation logic on which security professionals had built their assumptions. The distinction between active and inactive themes, previously considered a sufficient barrier, proves permeable through a preview path designed for administrator convenience.

The public availability of pwn.ai's proof-of-concept, combined with the simplicity of the initial vector—a clickable link delivered via email, message, or social engineering—demands a timely response. The absence of evidence of in-the-wild exploitation at the time of disclosure, as explicitly reported by sources, provides a mitigation window that narrows as technical details spread.

Frequently Asked Questions

Why does the installed theme remain inactive?: The CSRF primitive exploits the preview screen, not the activation flow. The theme is downloaded and made available for Customizer preview, but WordPress does not set it as the site's current theme. This invisibility is what makes the attack stealthy.
Can an attacker install a theme not present on WordPress.org?: No. According to the primary pwn.ai source, the Core bug does not itself accept an arbitrary ZIP archive. Forced installation is limited to themes published in the official WordPress.org catalog.
Can Editor or Author roles trigger the chain?: No. Patchstack has confirmed that only the Administrator role possesses the install_themes capability required to trigger the sequence. Lower roles cannot activate the primitive even if they click the malicious link.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter