www.it-connect.fr
Click2Shell: One Click Is All It Takes to Trigger PHP Code Execution in WordPress
A link, a single click from a logged-in administrator, and your WordPress site can install a malicious theme on its own. This attack has a name: Click2Shell. It is an exploitation chain targeting the WordPress Core CMS and can lead to PHP code execution on the server. A patch is available, but so is the exploit. Here’s what you need to know.
Once again, the WordPress Core has been in turbulent waters for several months. Last July, I published an article about wp2shell, a pre-authenticated RCE flaw discovered in the WordPress core. In August, it was XSS2Shell’s turn, as I mentioned in my cyber news roundup for the first half of August 2026. This time, Click2Shell is making headlines. As the saying goes, trouble never comes alone. And the count is complete.
The vulnerability was discovered by Paulos Yibelo, a researcher at pwn.ai, an autonomous penetration testing platform. He reported it to WordPress on August 22, 2026. The fix was introduced in WordPress 7.1.1, a release available since September 17, 2026, which includes patches for 11 security flaws.
"This research was carried out with our in-house tooling, Claude Opus 5 and a human working together", the researchers note in their report on Click2Shell.
For now, no CVE ID has been assigned to this vulnerability. So, is it critical or not? pwn.ai rates the forced theme installation at 7.1 out of 10 (CVSS 3.1), while the full chain could reach 9.3. It remains to be seen how WordPress will assess it.
One Parameter, Two Interpretations
It all starts on the theme installation page (wp-admin/theme-install.php), which accepts a theme parameter in the URL to open the preview of an official catalog theme directly. The problem is that this value is read twice, in two different ways:
- On the server side: the WordPress.org Themes API sanitizes the value and turns it back into a standard theme name. It therefore returns a valid catalog entry.
- In the browser: the admin interface JavaScript (
theme.js) reuses the raw value, without escaping, in a jQuery selector. With a few carefully chosen characters, this selector reaches the Install button... and WordPress triggers the click itself.
"The result is a theme preview that clicks Install by itself", the researchers summarize. The attacker does not need to provide anything: if you click the link while logged in as an administrator on your WordPress site, it is already too late.
However, installing an inactive theme is not enough to execute code on the server. So we have the first part of the exploitation chain, but the rest is still missing.
In reality, WordPress loads an inactive theme’s functions.php file during a preview in the Customizer. For its demonstration, pwn.ai used the Mobile Repair Zone 2.5.4 theme, which is available in the official WordPress theme catalog.
This theme included a function capable of installing a plugin from nothing more than a web address. The problem was that it checked nothing: neither the privileges of the user invoking it, nor the presence of a nonce, the one-time token specifically used to prove that a request really comes from the site and not from an external page. In other words, all it takes is pointing it to a malicious ZIP archive URL for WordPress to download it, extract it, and execute the code it contains. According to pwn.ai, more than 40 other third-party themes hosted on WordPress.org would reportedly present this type of weakness.
Ultimately, the attacker’s PHP code runs with the web server account, which leads to full site compromise. In fact, that is enough for the attacker to read the wp-config.php configuration file and create an account. Meanwhile, all of this remains invisible to site visitors: the active theme does not change.
Who Is Really Exposed?
First of all, it is important to understand that only a logged-in administrator can trigger the Click2Shell exploitation chain. An Author or Editor account does not have the necessary privileges to install a theme. The attacker therefore has two options:
- Targeted phishing: they must convince a specific administrator to click a malicious link while that person is logged in to the site.
- An existing XSS flaw: a pre-existing XSS on the site can automatically send the request from the administrator’s browser.
It should be noted that the currently active theme on the WordPress site does not matter. The attacker chooses the theme to install in order to trigger the attack, as long as it comes from the WordPress catalog.
All versions earlier than WordPress 7.1.1 are believed to be affected by this vulnerability. If you are not yet using WordPress 7, there are also fixed versions for older branches, from 7.0.5 to 4.7.36.
As of today, this vulnerability does not appear to be actively exploited. However, exploit code is now available following the publication of pwn.ai’s report. The situation could therefore evolve quickly.
