WordPress Click2Shell Flaw Lets Admins Unwittingly Install Malicious Themes
A critical vulnerability in WordPress core chains theme installation to code execution when logged-in administrators click a crafted link.
What to know
- WordPress patched a critical CVSS 9.6 vulnerability (Click2Shell) on September 17 that forces theme installation via malicious links opened by logged-in admins, with no separate CVE assigned yet.
- The attack exploits divergent URL parsing between WordPress.org's directory and the admin interface, automatically triggering the Install button without user clicks.
- The flaw chains with weaknesses in certain themes (like Mobile Repair Zone) to achieve remote code execution; WordPress core alone only installs real themes.
- No real-world attacks have been documented; immediate patching to 7.1.1 or equivalent is advised, with no alternative workaround available.
How it unfolded 3 developments, newest first · click a bar or a number to jump articlesposts
-
3
Public exploit code released for Click2Shell vulnerability
Technical details and proof-of-concept exploits for Click2Shell were published, making the attack methodology publicly available. The vulnerability is classified as a cross-site request forgery (CSRF) flaw in WordPress Core.
-
All WordPress users need to update their WordPress installations immediately 💯 There is a 9.2 CVE that discloses a remote code execution vulnerability that affects versions all the way back to 2016 😬 Here's the official notice
2 more of the top 3 · 28 posts in this stretch
-
C
WordPress patched an unauth path traversal yesterday: https:// github.com/WordPress/wordpress -develop/security/advisories/GHSA-7hp8-65ch-5whp https:// wordpress.org/news/2026/09/wor dpress-7-1-2-release/ This is now being exploited, a few hours later: https:// x.com/ethicalhack3r/status/210 2747373873004680
-
This kind of bug pathology is incredibly common in all sorts of programs and is the reason (disclaimer: self-plug) I wrote libpathrs[1].Sadly, almost all language standard libraries do not provide the right abstractions for dealing with files (the primary focus is on global paths as opposed to scoped paths or file descriptors / file handles) so…
-
-
2
pwn.ai releases full technical analysis of the attack chain
Security firm pwn.ai published detailed technical analysis showing how the core flaw works: WordPress.org's directory parser and the admin browser's DOM parser read URLs differently, allowing attackers to inject characters that trigger the Install button. The firm demonstrated chaining the forced install with a weakness in the Mobile Repair Zone theme to achieve code execution.
“The Core bug does not accept an arbitrary theme ZIP by itself.”
— pwn.ai -
1
Click2Shell vulnerability details published
Security coverage emerged across multiple outlets detailing the Click2Shell flaw, describing how crafted links can install themes without clicks and chain to code execution. The vulnerability affects WordPress versions 6.0 through those released before the fix.
-
first by BleepingComputer, 1d ago · also The Hacker News
1 more headline
-
first by heise online, 22h ago · also SecurityWeek
1 more headline
- WordPress Patches ‘Click2Shell’ Vulnerability SecurityWeek · 22h ago
-
-
background
WordPress releases 7.1.1 patch for Click2Shell vulnerability — WordPress released version 7.1.1 as a security update addressing a critical flaw in its core software that allows forced theme installation. The patch was distributed to supported branches back to version 4.7, with automatic updates rolling out to affected sites.
Also covered reported alongside — the timeline has no entry for these yet
-
2 outlets WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)
first by Help Net Security, 22h ago · also SecurityWeek
1 more headline
- Critical WordPress Vulnerability Exploited Immediately After Disclosure SecurityWeek · 40m ago
and 1 smaller piece
What people are saying 21 voices from 2 sites · best of 28 · verbatim
- Yesterday
-
Every so often I switch on the nginx endpoint that serves a 10TB zipbomb to clients that request anything `wp-*` that 404s (which is everything on my sites, I don't run WordPress).Sometimes the same IP address hits two or three URLs before going dead.Sure is quiet around here at night.
-
B
Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed. https://www. bleepingcomputer.com/news/secu rity/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution/
-
Is there a simple quick fix for older wp installs? I dont want to go through 20 meetings and two weeks of discussions
-
N
WordPress: Unauthenticated path traversal leading to conditional RCE: https:// github.com/WordPress/wordpress -develop/security/advisories/GHSA-7hp8-65ch-5whp Discussion: http:// news.ycombinator.com/item?id=4 9803959
-
Wordpress was the go-to for people who did not know programming and wanted a website.Has anything changed with AI? It did help me switch from wp to rust+dioxus, but I am a programmer.
-
P
Jesus, just STOP USING FUCKING WORDPRESS. https:// github.com/WordPress/wordpress -develop/security/advisories/GHSA-7hp8-65ch-5whp
- Sep 22
-
There was a time I looked up to Matt Mullenweg, but never to Wordpress.I've been building https://github.com/Qbix since 2008 and let me tell ya, I took a lot of great ideas from Drupal, Kohana, Symfony, etc. But never Wordpress. It's just ... a mess. Wordpress just won by being first, basically. Kind of like Bitcoin.PS: Years ago, I hired a guy in…
-
It's a wonderful piece of software. We've had one of our clients wanting us to "just provide a simple PHP install for wordpress, just hosting" (among some more complex java stuff company wrote for them).Site hacked within a day from install. Thankfully we have limited outogoing traffic (whitelist on proxy) so only thing exploit managed to replace…
-
T
WordPress patched a critical unauthenticated path traversal vulnerability (CVE-2026-87902, GHSA-7hp8-65ch-5whp, CVSS 9.2) in its page-template resolution function get_page_template(), discovered and responsibly disclosed by Robert Ressl. Under specific preconditions, such as an active theme with a top level directory starting with "page-" and a…
-
"WordPress 7.1.2 has been released containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7"As a courtesy, I try not to say more than one bad thing about WP every day. FWIW about 1/3 of installs are not on the recent 7 branch.
-
to be fair it is one of the top CMS's on the web (probably won't be in 2027) and its PHP / Mysql which in history have been very exploitable.
-
If I had to guess, which software on the web has been the most exploitable over all of the web's history, WP would surely be among the top candidates.People on HN love to talk smack about WordPress. After all these years, it's as much a reflex as shouting "walled garden!" every time there's an Apple story.Yet some of the biggest web sites on the…
-
The access log of public http servers is truly interesting to watch.You know that the scripts doing it are optimized for success rate, so the types of requests they send give you an impression of what's actually out there.It's clear to me that once we finally achieve rogue AGI, it is going to propagate through unpatched WordPress WooCommerce…
-
TBF, some of it is structural: if you're the most popular anything on the internet, you'll be the most attacked and the most exploited, and hence the most exploitable.
-
WordPress really is a piece of garbage software, and if you've ever developed plugins for it it is soooo apparent.The documentation is a perfect reflection of the absolute mess of spaghetti code that it is, half of the methods that you will use constantly when developing plugins are undocumented, even untyped. It's literally unusable.I know…
-
I am so happy that I asked Codex to rewrite our website as Hugo templates which allowed us to statically host it and get rid of Wordpress. So much stress gone!
-
These are the reason, why every easily reachable web server will be spammed with /something/something.php?somearg=someval. If I had to guess, which software on the web has been the most exploitable over all of the web's history, WP would surely be among the top candidates. Maybe right after MS Teams or Sharepoint or some stuff like that.
-
Ironically, this 9 years old comment on the official documentation page of one of the affected functions perfectly describes both the nature and remediation of this major security flaw:> Paul Ryan 9 years ago> Note that locate_template() does not prevent directory traversal attacks, so if you’re passing a user-provided template name to the…
-
pearcmd.php must exist, and register_argc_argv must be on, not common with hosting providers. But I am assuming the other themes and meeting conditions possibly affect a lot of WordPress sites.
-
O
「WordPressのClick2Shellの脆弱性により、ハッカーがサーバー上でPHPを実行できる。」： # BLEEPINGCOMPUTER 「WordPressのコアコンポーネントに影響を与える、Click2Shellと呼ばれる新たなクロスサイトリクエストフォージェリ（CSRF）脆弱性に関する技術的な詳細と概念実証エクスプロイトが公開されました。 このセキュリティ問題には公式な識別番号は付けられていませんが、先週リリースされた WordPressバージョン7.1.1 で対処されました。 これは、攻撃者が公式のWordPress.orgカタログにある任意のテーマをインストールし、任意のPHPファイルを実行できるようにする、事前認証済みのリモートコード実行チェーンです。」…
- Sep 21
-
B
Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed 'Click2Shell' that affects the platform's Core component. https://www. bleepingcomputer.com/news/secu rity/wordpress-click2shell-flaw-lets-hackers-execute-php-on-the-server/