On September 17, 2026, WordPress released version 7.1.1 — an emergency security update that fixes a vulnerability allowing a specially crafted link to automatically install and activate a preview of an inactive theme from the WordPress.org directory without explicit confirmation from the administrator. The vulnerability was discovered by researcher Paulos Yibelo and the pwn.ai team, who dubbed the attack chain Click2Shell. The patch is available for all supported WordPress branches from 4.7 and higher. Site owners are advised to update immediately.
Technical essence of the vulnerability
According to the official WordPress documentation, the issue is described as the ability of a “specially crafted URL to automatically install and activate the preview of an inactive theme from WordPress.org”. At the time of publication, the vulnerability has not been assigned a CVE identifier. WordPress has not published its own severity rating.
According to researchers from pwn.ai, the core vulnerability itself does not accept an arbitrary theme ZIP archive — it only installs a legitimate theme from the official WordPress.org directory chosen by the attacker. The attack mechanism is based on two WordPress components interpreting the same link differently: the WordPress.org directory treats the value in the URL as a regular theme name and returns a real package, while the administrator’s browser uses the raw link text — including special characters — in the interface code, which results in the install button being clicked automatically. Since the administrator is already authenticated, their session provides the required permissions and security token — the attacker does not need to forge them.
It is important to emphasize that, according to the researchers, exploitation requires an authenticated administrator to open the malicious link. This condition significantly limits the attack vector, although it does not eliminate the risk — phishing campaigns targeting WordPress administrators remain common.
The pwn.ai researchers assigned the core vulnerability a CVSS score of 7.1 (high), and the full chain through to code execution a CVSS score of 9.6 (critical). It should be borne in mind that these scores are researcher-assigned, not vendor-assigned — WordPress has not published its own severity rating.
Affected versions and scope
The official WordPress documentation records the fix for this vulnerability in the following security releases:
- WordPress 7.1.1
- WordPress 6.9.8
- WordPress 6.0.15
- WordPress 5.7.18
- WordPress 5.0.28
- WordPress 4.9.32
- WordPress 4.8.31
It is worth noting here the discrepancy with some secondary sources that state the lower bound of affected versions as 6.0. However, the official WordPress documentation explicitly includes the same vulnerability in releases 4.8.31 and 5.0.28, indicating a broader range of affected versions. WordPress also states that the fixes have been backported down to branch 4.7, whereas version 4.6 and earlier no longer receive security updates.
Chain to code execution
According to the researchers, the core vulnerability by itself only leads to installing a theme that remains inactive — the site’s appearance does not change. However, pwn.ai demonstrated that a path to arbitrary code execution on the server is possible if there is a separate vulnerability in the installed theme. This distinction is essential: the WordPress core vulnerability is not a standalone RCE.
Nevertheless, the attack chain scenario deserves attention. The WordPress ecosystem contains thousands of themes in the official directory, and their code quality is uneven. The ability to forcibly install an arbitrary theme from the directory expands the attack surface: a threat actor can deliberately choose a theme with a known vulnerability.
Previously, we covered an RCE vulnerability in the Forminator Forms plugin for WordPress — taken together, these cases highlight that the security of the WordPress ecosystem is determined not only by the core, but by the entire extension chain.
Recommendations
WordPress recommends updating immediately. Specific actions:
- Update WordPress to version 7.1.1 or to the corresponding patched release for your branch. Sites with automatic background updates enabled will receive the patch automatically.
- Check your current version via the WordPress dashboard → “Updates”.
- Sites running WordPress 4.6 or lower do not receive security updates and remain vulnerable — they need to migrate to a supported version.
- Audit installed themes — remove unused themes, especially those that have not been updated for a long time.
Neither WordPress nor pwn.ai has proposed a temporary workaround for those who cannot update immediately. At the same time, the attack requires an authenticated administrator to follow a malicious link — exercising extra caution when opening links from untrusted sources reduces the risk, but does not eliminate it.
Updating the WordPress core to a patched version fully closes the demonstrated attack vector, regardless of which themes are installed on the site. Given the lack of workarounds and the wide range of affected versions, the update priority is high, especially for sites whose administrators work with email and external links in the same browser where the WordPress dashboard is open.
