What's New
Security researcher Paulos Yibelo, who disclosed the WordPress "Click2Shell" vulnerability through pwn.ai on August 22, has now published his full technical report — including complete, working exploitation code. WordPress patched the underlying flaw in version 7.1.1, released September 17, but the newly public proof-of-concept means the exploitation path is no longer theoretical for anyone reading the writeup. See our original coverage of the initial disclosure for the full technical breakdown of the theme-install chain.
No official CVE identifier has been assigned to Click2Shell as of this publication.
The Attack, Recapped
Click2Shell is a cross-site request forgery (CSRF) bug rooted in a parsing mismatch: the WordPress.org theme directory and a logged-in administrator's own browser interpret the same crafted link differently, causing WordPress to silently force-install a theme from the official directory the moment an admin opens a malicious URL — no confirmation dialog, no second click, and the installed theme stays inactive so nothing looks different on the live site.
Chained with a separate unguarded AJAX handler in the "Mobile Repair Zone" theme, that forced install becomes a path to full remote code execution.
Attack Requirements
Despite reaching code execution, this is not a fully pre-authentication bug in the sense of requiring zero interaction: a logged-in administrator still needs to visit a crafted URL for the chain to fire. What attackers don't need is any WordPress credentials, installation nonces, or explicit admin privileges of their own — the admin's session does all the work once they click.
Who's Exposed
Affected: WordPress core 7.1.0 and earlier. Fixed in 7.1.1. The article reports no evidence of active in-the-wild exploitation as of publication — the risk here is that public exploit code now shortens the runway between "patch available" and "mass exploitation attempts," a pattern security teams have seen play out with other WordPress core bugs in the past.
Remediation
- Update to WordPress 7.1.1 immediately if you haven't already — this remains the only complete fix.
- Interim mitigation: enable the
DISALLOW_FILE_MODSsetting, which prevents the forced theme installation this chain depends on, if you cannot patch right away. - Audit installed themes for anything unrecognized — a successful Click2Shell attempt leaves an inactive, unexplained theme install as its signature artifact.
- If Mobile Repair Zone is present anywhere in your environment, remove it or confirm it's on a fixed version, since it was the specific chain component used to reach code execution.
- Treat links sent to administrator accounts with elevated suspicion — this chain fires on page load alone, with no further confirmation step.