WordPress administrators are being advised to update their sites after researchers revealed Click2Shell, an exploit chain capable of executing remote code on vulnerable websites through a single malicious link This article explores vulnerability starts wordpress. . The vulnerability starts with a WordPress Core theme-preview flaw that silently installs an attacker-selected theme from the official directory, leading to a server compromise when combined with insecure pre-activation code in the theme.
WordPress patched the Core flaw in version 7.1.1, released on September 17, 2026, as part of a comprehensive update containing 11 security fixes, 17 Core bug fixes, and 19 Block Editor fixes.
The official advisory describes the issue as specially crafted URLs automatically installing and previewing an inactive WordPress.org theme, attributing the discovery to Paulos Yibelo and pwn.ai, and recommends immediate updates to address the risk. A successful compromise could enable attackers to access wp-config.php and database credentials, read WordPress or WooCommerce data, alter files and content, create users, steal secrets, and potentially seize the wider hosting environment. WordPress fixed the selector injection in changeset 63664, which restricts matching to a genuine div.theme card and applies jQuery's escapeSelector() to the URL-derived slug before constructing the selector.
Administrators should also ensure automatic updates are enabled, review recently installed themes and plugins, inspect unexpected PHP files and account changes, and investigate suspicious requests to theme-install.php or Customizer-enabled admin-ajax.php endpoints.
