WordPress fixes theme-install flaw that enabled takeover
WordPress 7.1.1 fixes Click2Shell, a vulnerability that could let an attacker trick a logged-in administrator into installing a theme and then exploit that theme to run malicious code on the server. According to Patchstack security researcher Chazz Wolcott's September 18, 2026 account, pwn.ai's Paulos Yibelo responsibly reported the flaw, which was addressed in the September 17 release. The result could be serious, but the attack requires administrator involvement and additional conditions, not simply a visit from an ordinary website reader.
Click2Shell combines Cross-Site Request Forgery (CSRF), which tricks a signed-in browser into making an unwanted request, with selector injection, which changes the instructions browser code uses to locate page elements. Together, those weaknesses can initiate a theme installation the administrator did not intend. The full attack then uses a vulnerable theme to reach remote code execution (RCE), meaning an attacker can run their own code on the website's server.
The starting point is WordPress's built-in ability to preview and install themes from the WordPress.org catalog inside its administration panel. That process puts a theme's slug, its short identifying name, into a URL, or web address. Two different parts of WordPress then interpret the same value differently. The WordPress.org Themes API, the interface used to request catalog information, sanitizes the value by removing extra characters. In Patchstack's example, twentytwenty\"]> becomes twentytwenty before the response comes back.
In the browser, however, JavaScript, the code that makes the administration page interactive, used the original value without that cleaning. It placed the value directly into a selector string used by jQuery, a JavaScript library. A selector is an instruction for finding particular items on a page. Special characters in the supplied slug could therefore alter what the instruction selected, making the page behave as though the administrator had clicked Install for a different theme. Cleaning the value on the server did not make its separate use in the browser safe.
An unwanted but inactive theme installation was only the first stage. Patchstack notes that inactive themes and plugins, or add-on features, are generally not running their normal functionality, although inactivity should not be treated as a security guarantee. The crucial exception here was the WordPress Customizer, which temporarily runs a selected theme to show a preview. Previewing the vulnerable theme was enough to expose the next part of the chain, without making it the site's permanent active theme.
pwn.ai's demonstrated chain used Mobile Repair Zone 2.5.4, a real theme in the catalog. After the crafted address caused its installation, a follow-up link opened the Customizer with that theme running. Its functions.php file, which contains theme code, then executed and registered hooks, the connections that tell WordPress when to run particular functions. Among them was an AJAX handler, a function that receives browser requests without requiring a full page reload, that accepted a plugin download address.
That handler lacked both a nonce check, which checks a temporary token intended to help reject forged requests, and capability checks, which establish whether a user has permission to perform an action. Supplying an attacker-controlled ZIP file, a packaged collection of files, caused WordPress to download it as a plugin and execute its code on the server. This provided a remote shell, a way for the attacker to issue commands to the compromised system. The takeover depended on the combination of the WordPress flaw, the theme installation and the theme's unsafe handler.
The access requirements matter. Although the attacker did not need an account, an administrator had to load the specially crafted address while signed in. A normal visitor, an Author or an Editor could not trigger this chain. One route was targeted phishing, a deceptive message persuading a particular administrator to follow the attacker's link. Another was Cross-Site Scripting (XSS), a separate weakness that lets an attacker inject browser code into a website. If an administrator viewed that code, it could automatically make the request in their browser. That second route required another component to be vulnerable already; Click2Shell would exploit an existing foothold rather than create it from nothing.
The complete code-execution outcome also required the site to be able to install the vulnerable theme. Patchstack says that when DISALLOW_FILE_MODS, a WordPress setting that blocks file modifications including new theme and plugin installations, is enabled, the injection could still occur but could not extend to installing those new components. This is a limit on the described chain, not a substitute for fixing the underlying flaw.
WordPress 7.1.1 changes the vulnerable selector in two ways. It restricts selection to actual .theme elements in the DOM, the browser's structured representation of the page, and passes the slug through $.escapeSelector(), a function that makes special characters safe for use in a selector. The supplied name is consequently handled as literal text rather than instructions that can redirect a button action. The wider development lesson is precise: when server and browser code independently process the same input, each use needs protection appropriate to its own context.
Patchstack states that its customers are protected, but still recommends immediately updating to the most recent available WordPress version. Its account does not describe the protection mechanism or establish whether Click2Shell has been exploited in real-world attacks. For owners who need operational help, AEU Hosting provides managed WordPress hosting with security hardening and expert support, relevant to maintaining a site but not evidence of protection against this specific chain. The priority remains installing the WordPress fix and avoiding unexpected administration links, even when they appear to lead to a familiar theme preview.