WordPress 7.1.1 Patches Click2Shell: Crafted Links Can Force Theme Installs and Chain to Code Execution
WordPress 7.1.1 Patches Click2Shell: Crafted Links Can Force Theme Installs and Chain to Code Execution
WordPress has shipped a security release fixing a new core vulnerability that allows a crafted web link, opened by a logged-in administrator, to install a theme from the official WordPress.org directory without anyone clicking Install. The security firm pwn.ai, whose researchers reported the flaw, calls the attack chain Click2Shell — and demonstrated that it can be combined with a weakness in the installed theme to run attacker code on the server.
The fix shipped on September 17 in WordPress 7.1.1, a security release whose patches reach supported branches back to 4.7. The flaw itself affects WordPress from version 6.0 up through the releases just before the fix. There is no sign the flaw has been used in real attacks, and no CVE identifier has been assigned yet, though pwn.ai says WordPress plans to add one.
How a Link Clicks Install
The bug works because two parts of WordPress read the same link differently. The WordPress.org directory treats the value in the link as an ordinary theme name and returns a real theme. The administrator's browser, meanwhile, reuses the original text — punctuation and all — inside code meant to pick out an item on the page. Characters the attacker adds to the link send that code to the Install button, and WordPress's own script clicks it. Because the administrator is already logged in, their session supplies the permission and the security token the install needs — the attacker supplies neither.
The installed theme stays switched off, so the site's appearance never changes and nothing looks wrong. But an installed theme is not always idle: when WordPress builds a preview in its Customizer tool, it can load a theme's PHP code even before the theme is switched on. pwn.ai chained the forced install with a second flaw in the demo theme, Mobile Repair Zone, whose background handler fetched a web address from the request, downloaded a package, and ran its code with no permission or token check — achieving code execution. "The Core bug does not accept an arbitrary theme ZIP by itself," the researchers noted.
pwn.ai rates the forced-install flaw alone at CVSS 7.1 and the full chain to code execution at 9.6. WordPress, which has not published its own severity rating, described the issue as: "Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org."
What Should You Do?
- Update to WordPress 7.1.1 — or the matching security release for your branch — immediately. This is a security release; sites set to update automatically will receive it on their own. Neither WordPress nor pwn.ai offered a separate workaround, and the attack only needs a logged-in administrator to open a link.
- Audit your theme inventory for unexpected inactive themes. A forced install leaves no visible trace on the site — an unfamiliar inactive theme in your dashboard is exactly the artifact this attack produces.
- Don't rely on link hygiene alone. The malicious link needs no fake button and no user interaction beyond opening the page; admin training helps, but only the core update closes the demonstrated chain.
- Check your exposure to wp2shell too. A different WordPress core flaw disclosed in July — wp2shell, which needs no login and no click — is listed by CISA as actively exploited. Click2Shell has not been exploited, but if you have deferred WordPress core updates this quarter, patch both in the same maintenance window.
The WAF Angle
Click2Shell is the CSRF-shaped attack that nonces cannot stop — because WordPress's own script performs the action with a perfectly valid session. That should reset assumptions for every application team: security tokens defend against requests that bypass the app, not against the app being tricked into clicking its own buttons. For WordPress operators behind a WAF, three practical layers matter. First, treat theme- and plugin-install endpoints as high-value paths: restrict them by IP, or re-authenticate before install actions, so a session alone is never enough. Second, a WAF can help on delivery — crafted-link campaigns are detectable as anomalous referers and path patterns hitting admin URLs — but only the core patch closes the chain regardless of theme. Third, the Customizer lesson generalizes: preview paths that execute PHP are code paths, and WAFNinja's guidance on hardening admin surfaces applies to every one of them. With pwn.ai now on its second chained WordPress core exploit since August, the auto-update pipeline remains the single most important WordPress security control you own.
