WordPress Patches Critical RCE Flaw in Latest Security Update
WordPress released a security update last week addressing 11 vulnerabilities, including a severe flaw dubbed Click2Shell that could enable remote code execution (RCE). The bug, discovered and reported by pwn.ai, allows unauthenticated attackers to exploit specially crafted URLs to install and preview inactive themes without an administrator’s knowledge or consent.
The vulnerability arises from a discrepancy in how WordPress’s themes API and JavaScript in an admin’s browser interpret a value in the theme-preview URL. While the API processes it as a standard theme slug, the browser retains the original punctuation, enabling attackers to inject malicious code via a jQuery selector. This forces the installation of an attacker-selected theme from WordPress.org’s official catalog, which despite being inactive can still execute PHP code during a Customizer preview.
Pwn.ai identified over 40 third-party themes that could be abused for RCE, as their PHP code loads even when inactive. Exploitation requires only a single visit from a logged-in admin, granting attackers full control over the site. Notably, the attack leaves the primary theme active, making detection difficult.
WordPress patched Click2Shell and the other vulnerabilities in version 7.1.1, extending fixes back to WordPress 4.7. Pwn.ai received a $300 bounty the platform’s maximum reward for the discovery. Technical details and a proof-of-concept (PoC) exploit were also published.
Source: https://www.securityweek.com/wordpress-patches-click2shell-vulnerability/
WordPress cybersecurity rating report: https://www.rankiteo.com/company/wordpress
"id": "WOR1790079856",
"linkid": "wordpress",
"type": "Vulnerability",
"date": "9/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'WordPress users running '
'vulnerable versions (prior to '
'7.1.1)',
'industry': 'Technology/Software',
'name': 'WordPress',
'type': 'Content Management System (CMS)'}],
'attack_vector': 'Specially crafted URLs exploiting theme-preview '
'functionality',
'customer_advisories': 'WordPress users advised to update to the latest '
'version (7.1.1 or later).',
'description': 'WordPress released a security update addressing 11 '
'vulnerabilities, including a severe remote code execution '
'(RCE) flaw dubbed Click2Shell. The bug allows unauthenticated '
'attackers to exploit specially crafted URLs to install and '
"preview inactive themes without an administrator's knowledge "
'or consent. The vulnerability arises from a discrepancy in '
"how WordPress's themes API and JavaScript in an admin's "
'browser interpret a value in the theme-preview URL, enabling '
'attackers to inject malicious code via a jQuery selector. '
'This forces the installation of an attacker-selected theme '
"from WordPress.org's official catalog, which can execute PHP "
'code during a Customizer preview.',
'impact': {'operational_impact': 'Full control over affected WordPress sites '
'if exploited',
'systems_affected': 'WordPress websites running versions prior to '
'7.1.1 (back to 4.7)'},
'investigation_status': 'Patched',
'post_incident_analysis': {'corrective_actions': 'Patch released to fix the '
'vulnerability in WordPress '
'versions 7.1.1 and '
'backported to 4.7.',
'root_causes': 'Discrepancy in theme slug '
'interpretation between WordPress '
'themes API and browser JavaScript, '
'enabling jQuery selector '
'injection.'},
'recommendations': 'Update WordPress to version 7.1.1 or later to mitigate '
'the vulnerability. Monitor for unusual theme '
'installations or previews.',
'references': [{'source': 'pwn.ai'}],
'response': {'containment_measures': 'Security patch released in WordPress '
'version 7.1.1',
'remediation_measures': 'Update to WordPress version 7.1.1 or '
'later',
'third_party_assistance': 'Reported by pwn.ai'},
'title': 'WordPress Critical RCE Flaw (Click2Shell) Patched in Latest '
'Security Update',
'type': 'Remote Code Execution (RCE)',
'vulnerability_exploited': 'Discrepancy in theme slug interpretation between '
'WordPress themes API and browser JavaScript '
'(jQuery selector injection)'}