WordPress Patched Click2Shell After One Admin Click Could Quietly Hand Attackers the Site

A single click by a logged-in WordPress administrator was enough to hand an attacker the whole site, and the person running it might never have noticed.

WordPress has patched a core flaw nicknamed Click2Shell, part of the 7.1.1 security release on 17 September that fixed 11 vulnerabilities in total. According to SecurityWeek, the bug could be triggered through specially crafted URLs that automatically install and preview inactive themes, a behavior that sounds harmless until you follow where it leads.

The flaw came down to two parts of WordPress disagreeing about the same value. The themes API treated a value in the theme-preview URL as an ordinary theme slug, while the JavaScript running in the admin's browser kept the original punctuation and dropped it into a jQuery selector. That mismatch let an attacker force the site to install a theme they chose, pulled straight from the official WordPress.org catalog, using the administrator's own session.

No attacker WordPress account was required. What it needed was a logged-in admin to open one crafted theme-preview link, delivered by phishing or a stored cross-site scripting bug, at which point the browser did the rest.

The installed theme stayed inactive and the site's appearance never changed, which is what made it quiet. But pwn.ai, credited with finding and reporting the issue, said more than 40 third-party themes on WordPress can still run PHP while inactive, because their code loads during the Customizer preview even when another theme is active. Chaining one of those installers turned a silent theme install into remote code execution under the WordPress server account.

There were guardrails. Sites that set DISALLOW_FILE_MODS block the theme-install stage outright, and WordPress fixed the core issue by escaping the slug and tightening the selector. The company also backported the patch across older branches all the way to WordPress 4.7.

The flaw carried no CVE identifier at disclosure, and pwn.ai's researcher Paulos Yibelo reported it on 22 August. WordPress paid out $300, its maximum bug bounty, a modest figure for a bug that could quietly reach code execution.

Administrators who keep automatic updates on are already covered. The chain still needed a logged-in admin to open the crafted link, so it never became an unauthenticated drive-by on every WordPress site, and it stays separate from the template path-traversal fix in 7.1.2. Migration and takeover bugs in popular plugins keep the WordPress ecosystem a favorite target. As with the decoder chain that reached RCE through a crafted image file, the danger here was in the plumbing, not the payload the admin thought they were clicking.