WordPress fixed a security flaw that can let an attacker take over a website if a logged-in administrator visits a malicious link. The bug, dubbed Click2Shell and not yet assigned a CVE, affects WordPress and was patched in version 7.1.1, with backported fixes to versions as old as 4.7. It abuses theme preview and automatic installation from the official WordPress.org catalog, and researchers published technical details and proof-of-concept code showing how inactive third-party themes can be used for remote code execution.
Why it matters: WordPress powers a large share of the web, so a one-click admin-targeted path to server-side code execution is high risk. Site owners should update WordPress immediately, especially because public proof-of-concept code is available and the exploit can be hard for administrators to notice.
Ionut Arghire
2026.09.22
100% relevant
This article appears to be the first tracked item here about the specific Click2Shell WordPress core vulnerability and its patch release in WordPress 7.1.1.
← Back to all stories