WordPress administrators are being advised to upgrade after researchers revealed Click2Shell, an exploit chain capable of enabling remote code execution (RCE) on vulnerable websites. WordPress patched the Core flaw in version 7.1.1, released September 17, 2026, as part of an update containing 11 security fixes, 17 Core bug fixes, and 19 Block Editor fixes. The official advisory describes the issue as specially crafted URLs automatically installing and previewing an inactive WordPress.org theme, crediting Paulos Yibelo and pwn.ai, and urging users to update immediately.
Click2Shell WordPress Vulnerability The administrator's authenticated session grants installation capabilities and nonce, enabling trusted WordPress JavaScript to perform sensitive actions on behalf of the attacker.
The handler received plugin details and a package URL, downloaded and unpacked the supplied archive, and loaded the PHP entry point, allowing code execution under the web server’s account. A successful compromise could enable attackers to access `wp-config.php` and database credentials, read WordPress or WooCommerce data, alter files and content, create users, steal secrets from the PHP worker, and potentially seize the entire hosting environment. Administrators should also ensure automatic updates are enabled, review recently installed themes and plugins, inspect unexpected PHP files and account changes, and investigate suspicious requests to theme-install.php or Customizer-enabled admin-ajax.php endpoints.
Empower your SOC with instant IOC context for immediate response: Integrate TI Lookup into your SOC.
