WordPress Click2Shell: crafted admin theme-preview URL forces catalog theme install; chain to RCE (fixed 7.1.1)
WordPress 7.1.1 maintenance and security release (17 September 2026) fixes a core flaw pwn.ai calls Click2Shell: a specially crafted theme-preview / theme-install URL, when opened by a logged-in administrator, can automatically install an attacker-selected theme from the official WordPress.org catalog without the admin clicking Install (release wording: “Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org.”). Root cause is divergent interpretation of the theme value — WordPress.org Themes API canonicalises it to a real slug, while wp-admin JavaScript reuses the original punctuation inside a jQuery selector and triggers Install. On its own the core bug only installs a real catalog theme (site appearance unchanged while inactive). pwn.ai demonstrated chaining with a separate unprotected AJAX installer in the then-current Mobile Repair Zone 2.5.4 catalog theme (and noted similar patterns in 40+ third-party themes): Customizer preview loads inactive-theme PHP, then an unauthenticated AJAX handler fetches and runs attacker-supplied package code. Researcher severity: CVSS 3.1 7.1 (forced-install alone, High) and CVSS 3.1 9.3 (full chain with UI:R). No CVE assigned at disclosure (WordPress indicated one forthcoming); no in-the-wild exploitation claimed. Fix: WordPress 7.1.1 (security fixes also backported through supported older branches to 4.7). Primary: WordPress 7.1.1 release; research: pwn.ai; wire: The Hacker News 18 Sep 2026.
- Product
- WordPress core (theme install / preview); chain demo used Mobile Repair Zone theme 2.5.4
- Versions
- WordPress before 7.1.1 (core issue; security release backports through 4.7 branch where applicable)
- CVSS
- 7.1 standalone / 9.3 chained (CVSS 3.1, pwn.ai researcher; no vendor score yet)
- Exploited in Australia?
- unknown
- Patch to
- Upgrade to WordPress 7.1.1 (or the matching security backport for your branch); automatic updates will pull it where enabled
Primary: WordPress — 7.1.1 maintenance and security release (17 Sep 2026) · Vendor: WordPress.org News — 7.1.1 · pwn.ai — Click2Shell research (also THN 18 Sep 2026)