WordPress Click2Shell flaw lets hackers execute PHP on the server
Source Bleeping Computer
Fixed in 7.1.1 : patch WordPress Core as a priority.
Data as of 21 Sep 2026, 18:31 UTC
Rated Critical by Threat Radar from the Bleeping Computer text
- Affects
- WordPress Core up to 7.1.0
- Patch
- Available – fixed in 7.1.1
What to do
AI-suggested
An official fix is available in WordPress version 7.1.1, which should be applied promptly. For administrators unable to update immediately, enabling the DISALLOW_FILE_MODS setting prevents forced installation of themes or plugins, mitigating the attack vector. Since the vulnerability requires a logged-in administrator to visit a malicious link, educating administrators to avoid suspicious URLs and preventing phishing or cross-site scripting attacks can reduce risk. However, updating to the latest WordPress version remains the strongest mitigation.
Description
Click2Shell is a cross-site request forgery (CSRF) vulnerability in WordPress Core up to version 7.1.0 that allows unauthenticated attackers to execute arbitrary PHP code on the server by forcing the installation of a theme from the official WordPress.org catalog. The attack requires a logged-in administrator to visit a crafted URL, which triggers the execution of PHP code via an inactive theme during a Customizer preview. This vulnerability was fixed in WordPress version 7.1.1 by escaping the theme slug and restricting jQuery selectors. The flaw enables remote code execution that could lead to file manipulation, data access, and creation of rogue admin accounts.