The Click2Shell vulnerability is a pre-authenticated remote code execution chain affecting WordPress Core versions up to 7.1.0. It exploits a CSRF flaw where a value from a theme-preview URL is interpreted twice—once by the WordPress.org Themes API and again by JavaScript in the administrator's browser—allowing an attacker to install any theme from the official catalog without explicit administrator action. Even inactive themes can execute PHP during a Customizer preview, enabling arbitrary PHP execution on the server. The attack requires a logged-in administrator to visit a maliciously crafted URL. The vulnerability was responsibly disclosed by security researcher Paulos Yibelo and fixed in WordPress 7.1.1 by escaping the theme slug in jQuery selectors and limiting selector scope to actual theme cards. Patchstack analysis confirms that only administrators can trigger the exploit, and mitigation includes disabling file modifications via the DISALLOW_FILE_MODS setting.

Successful exploitation allows remote code execution on the WordPress server without attacker authentication, provided a logged-in administrator visits a crafted URL. This can lead to file modification and deletion, unauthorized access to sensitive files such as wp-config.php containing database credentials and authentication secrets, creation of rogue administrator accounts, and injection of malicious scripts. The vulnerability affects WordPress sites running version 7.1.0 and earlier, potentially compromising site integrity and confidentiality.

An official fix is available in WordPress version 7.1.1, which should be applied promptly. For administrators unable to update immediately, enabling the DISALLOW_FILE_MODS setting prevents forced installation of themes or plugins, mitigating the attack vector. Since the vulnerability requires a logged-in administrator to visit a malicious link, educating administrators to avoid suspicious URLs and preventing phishing or cross-site scripting attacks can reduce risk. However, updating to the latest WordPress version remains the strongest mitigation.