WordPress released patches on September 17 addressing Click2Shell, a high-severity vulnerability allowing attackers to force theme installations from specially crafted links without requiring user interaction beyond opening the malicious URL. The vulnerability works when logged-in administrators open attacker-crafted links, with neither clicking nor typing passwords necessary once they reach the page.
Security researchers at pwn.ai discovered the flaw and demonstrated how it chains with existing theme vulnerabilities to achieve complete code execution on affected servers. The attack installs a real theme from WordPress.org that remains inactive and invisible to visitors. However, when WordPress builds preview pages in its Customizer tool, the installed theme’s PHP code executes even before activation occurs.
The technical root cause involves two different parts of WordPress reading the same link differently. WordPress.org treats the URL value as a simple theme name and returns the correct package. However, the administrator’s browser processes the same link differently, reusing original text and punctuation inside code designed to identify page elements. Attackers craft links containing special characters that send instructions directly to the Install button, which WordPress’s own scripts then activate automatically.
Click2Shell represents a broader pattern in 2026 where vulnerability chaining transforms individually-moderate flaws into critical exploits. Defenders face critical vulnerabilities in WordPress Core, unauthenticated plugin flaws providing administrator access, remote code execution through form-processing logic, and malicious software delivered through trusted update infrastructure. Outdated plugins and themes remain responsible for 90%+ of compromised WordPress sites.
The researchers tested Click2Shell using the Mobile Repair Zone theme, which contained a second vulnerability allowing background handlers to fetch web addresses and execute downloaded code without permission checks. Chaining both flaws achieved arbitrary code execution. Similar critical chains affect popular themes, such as Avada experiencing a six-flaw exploit chain enabling zero-click remote code execution with 9.8 CVSS severity.
Administrators’ existing sessions provided all necessary permissions and security tokens when opening malicious links, eliminating attacker supply needs and significantly simplifying the attack chain. WordPress REST API security architecture lacks robust standardized authentication mechanisms, with different plugins implementing incompatible schemes creating fragmented security.
The platform rated the forced-install flaw alone as 7.1 CVSS, and the full chain as 9.6. WordPress 7.1.1, released September 17, fixes Click2Shell for installations running version 6.0 and later, with updates reaching branches back to 4.7. However, vulnerabilities move from patch disclosure to exploitation in hours, leaving organizations with disabled automatic updates facing minimal exposure windows.
Pakistani WordPress administrators should update immediately to 7.1.1 or their matching version. The vulnerability requires administrator access to malicious links, but potential code execution warrants urgent attention across Pakistani hosting providers and WordPress services supporting businesses nationwide.
