A Link WordPress and Your Browser Read Differently
WordPress has shipped version 7.1.1 to fix a set of core vulnerabilities, the headline of which security firm pwn.ai has dubbed "Click2Shell." The bug is a parsing discrepancy: two parts of WordPress interpret the same crafted link differently. The WordPress.org theme directory reads the value in the link as an ordinary theme name and hands back a real theme package. The administrator's own browser, however, reuses that same raw text — punctuation and all — inside code meant to pick out a specific item on the admin page.
The mismatch means a logged-in administrator who simply opens a malicious link triggers WordPress to automatically install a theme from the official WordPress.org directory in the background — no confirmation dialog, no second click. The installed theme stays inactive, so nothing changes visibly on the live site, leaving the admin with no obvious sign anything happened.
From Silent Install to Root Shell
On its own, the forced-install bug carries a CVSS score of 7.1 (high) — serious, but not yet code execution. pwn.ai demonstrated how to push it further by chaining it with a separate flaw in the "Mobile Repair Zone" theme: a background AJAX-style handler in that theme performs no permission validation before acting. By forcing the install of that specific vulnerable theme via Click2Shell and then hitting its unguarded handler, an attacker can escalate the chain to full remote code execution — CVSS 9.6 (critical).
No CVE identifier has been assigned to Click2Shell itself yet, though WordPress has indicated one is forthcoming.
Who's Exposed
Affected: WordPress core from version 6.0 up to the version immediately preceding the September 17, 2026 patch. The forced-install primitive requires only that an administrator (or any user with theme-install capability) click a crafted link — classic CSRF-adjacent exploitation, no plugin required.
Not affected once patched: Sites updated to 7.1.1 or the corresponding security release backported for supported branches back to 4.7.
Remediation
- Update to WordPress 7.1.1 or the matching security release for your branch immediately — there is no supported workaround short of patching.
- Audit installed themes for anything unrecognized, especially inactive themes nobody on the team remembers installing — a Click2Shell exploit attempt leaves exactly that kind of artifact.
- If Mobile Repair Zone is present anywhere in your environment, remove it or confirm it has been updated to a fixed version; it's the specific chain component pwn.ai used to reach code execution.
- As a general hardening measure, be cautious with links sent to logged-in WordPress administrator accounts — this bug is triggered purely by a page load, not a follow-up confirmation click.