Security researchers have published technical details and a proof-of-concept exploit for Click2Shell, a newly disclosed WordPress Core vulnerability that can be chained with a vulnerable theme to execute arbitrary PHP code on a server after a logged-in administrator visits a malicious link.
The underlying WordPress flaw allows an unauthenticated attacker to craft a URL that causes an administrator’s browser to automatically install and preview a theme from the official WordPress.org catalog. The administrator does not need to deliberately install or activate the theme.
Researchers at pwn.ai demonstrated that the behavior can be chained with a separate vulnerability in a catalog theme to achieve remote code execution, potentially giving an attacker control over the affected WordPress installation.
The disclosure comes weeks after researchers detailed critical WP2Shell vulnerabilities capable of turning WordPress flaws into remote code execution, highlighting continued research into attack chains that transform seemingly narrower WordPress weaknesses into full server compromise.
WordPress fixed the Core component of Click2Shell in 7.1.1, released Sept. 17, 2026. With complete technical details and proof-of-concept code now public, administrators running affected versions should update immediately.
One malicious link can trigger the chain
Click2Shell was discovered by security researcher Paulos Yibelo and the pwn.ai research team while examining WordPress Core for pre-authentication remote code execution chains.
The vulnerability originates in the way WordPress handles values supplied through theme preview URLs.
A value from the URL is processed by the WordPress.org Themes API and also reused by JavaScript running inside the administrator’s browser. The Themes API sanitizes the value into a normal theme slug, while the browser previously inserted the original value into a jQuery selector without properly escaping it.
An attacker can exploit that difference to manipulate the selector and cause WordPress’s own JavaScript to activate the legitimate Install control for an attacker-selected theme.
The result is that simply loading a specially crafted URL can cause WordPress to download and install a theme from the official catalog without the administrator explicitly clicking Install.
The attack does not require the threat actor to possess a WordPress account, administrative credentials or an installation nonce.
It does, however, require a logged-in administrator to visit the malicious URL. Users with Author or Editor privileges do not have the permissions required to install themes and therefore cannot trigger the complete chain.
Inactive themes can still execute PHP
Automatically installing a theme does not by itself provide remote code execution. The researchers therefore investigated whether an installed but inactive theme could execute PHP before activation.
They found that WordPress loads PHP belonging to an inactive theme when the administrator opens it through the Customizer preview functionality.
For their demonstration, researchers chained the WordPress Core vulnerability with a separate flaw in version 2.5.4 of the Mobile Repair Zone theme.
The vulnerable theme contained an AJAX handler that lacked nonce and capability checks and could accept a plugin package selected by the attacker. Researchers used that behavior to write and execute attacker-controlled PHP on the server.
The resulting chain allowed a malicious link to force WordPress to install the catalog theme, load its PHP through the Customizer, reach the vulnerable installer and execute attacker-supplied code.
The site’s existing active theme can remain unchanged throughout the attack, potentially making the compromise less obvious to an administrator.
Server compromise could expose WordPress secrets
Successful PHP execution under the WordPress server account can provide an attacker with extensive access to a compromised installation.
Depending on the server configuration, an attacker could potentially modify or delete files, inject malicious scripts, access WordPress user information and establish persistence.
Server-side access could also expose wp-config.php, which commonly contains database connection credentials and WordPress authentication secrets.
Attackers able to maintain control of a compromised installation could potentially create rogue administrative users, modify site content, steal database information or use the website to distribute malicious code.
The demonstrated remote code execution chain depends on a second vulnerable component. Click2Shell’s underlying WordPress Core flaw allows forced installation and preview of a catalog theme, but arbitrary PHP execution requires additional vulnerable functionality that can be chained with it.
Researchers demonstrated the attack using Mobile Repair Zone and said they identified numerous other third-party themes containing potentially relevant vulnerabilities.
Phishing could deliver Click2Shell
Because an administrator must visit the crafted URL while authenticated, targeted phishing provides one possible delivery mechanism.
An attacker could attempt to convince a WordPress administrator to open the malicious link while an active administrative session exists in the browser.
Another potential path involves cross-site scripting on the target website. Malicious JavaScript running when an administrator views an affected page could cause the browser to issue the required request without the administrator deliberately opening a phishing link.
That second scenario would require an attacker to already possess another exploitable foothold, such as an XSS vulnerability in a WordPress component.
The administrator requirement means Click2Shell should not be interpreted as a vulnerability allowing anyone on the internet to immediately execute PHP against an unpatched WordPress installation without user interaction.
However, the attacker does not need their own authenticated WordPress account, and successful exploitation can escalate a single administrator interaction into server-side code execution when the Core flaw is combined with a suitable vulnerable theme.
WordPress 7.1.1 blocks the attack
Paulos Yibelo reported the WordPress Core issue on Aug. 22, 2026. WordPress reproduced the behavior against 7.1.0 and began developing a fix.
Researchers provided WordPress with the complete pre-activation remote code execution chain on Sept. 1.
WordPress released 7.1.1 on Sept. 17 as a maintenance and security update containing 11 security fixes, including the Click2Shell Core issue.
The patch changes how WordPress handles the theme slug inside its JavaScript selector. WordPress now escapes the value before using it and restricts the selector to legitimate theme elements, preventing crafted characters from manipulating which interface control is selected.
The researchers said the Core issue is expected to affect WordPress versions before 7.1.1. The vulnerability did not have a CVE identifier when the technical research was published, although pwn.ai said WordPress was working to obtain one.
WordPress recommends that administrators install the latest security release immediately.
For environments where an immediate update is not possible, Patchstack noted that installations configured with DISALLOW_FILE_MODS cannot be forced through this attack path to install a new theme or plugin.
Updating remains the recommended mitigation, particularly now that researchers have released the technical details necessary to reproduce the vulnerability.
Click2Shell follows earlier WordPress RCE research
Click2Shell continues a series of recent WordPress vulnerability chains demonstrating how weaknesses with limited individual impact can become significantly more dangerous when combined.
As BreachNews previously reported, WP2Shell research demonstrated critical WordPress attack chains capable of escalating web vulnerabilities into remote code execution.
Click2Shell follows the same broader security concern from a different direction. Rather than relying on a single vulnerability that immediately provides server control, the attack abuses WordPress Core to introduce an attacker-selected component and then uses vulnerable functionality inside that component to complete the compromise.
There is currently no public evidence that Click2Shell has been exploited in real-world attacks.
The publication of a working proof of concept changes the risk for administrators, however, by giving attackers technical information needed to reproduce the chain against systems that remain vulnerable.
