WordPress Patches ‘Click2Shell’ Vulnerability
Source SecurityWeek
Fixed in 7.1.1 : patch affected systems as a priority.
Data as of 22 Sep 2026, 10:32 UTC
Rated Critical by Threat Radar from the SecurityWeek text
- Patch
- Available – fixed in 7.1.1
What to do
AI-suggested
WordPress has released an official patch for the Click2Shell vulnerability in version 7.1.1 and backported fixes to all supported versions back to 4.7. Site administrators should upgrade to WordPress 7.1.1 or later, or apply the corresponding security updates for their WordPress version. No additional mitigation actions are required beyond applying the official patches.
Description
WordPress patched a vulnerability called Click2Shell that allowed attackers to automatically install and preview inactive themes via specially crafted URLs. This flaw could lead to remote code execution (RCE) by abusing how theme slugs are interpreted differently by the themes API and JavaScript in an administrator's browser. Attackers could force installation of attacker-selected themes fetched from the official WordPress.org catalog without administrator consent. Some inactive third-party themes could be exploited for PHP code execution during the Customizer preview, enabling attackers to execute code under the WordPress server account without needing an attacker WordPress account. The vulnerability was fixed in WordPress version 7.1.1 and backported to versions as early as 4.7.