● Covered by 3 sources · 4 reportsMedium impact2 negative2 neutral
WordPress Patches Click2Shell Vulnerability Allowing Forced Theme Installs
Key points
- WordPress 7.1.1 fixes a Click2Shell vulnerability.
- A crafted link can force theme installation without user interaction.
- The flaw can chain with other vulnerabilities for code execution.
- No evidence of in-the-wild exploitation has been found.
- Click2Shell is a cross-site request forgery (CSRF) vulnerability.
- The flaw affects WordPress 7.1.0 and earlier versions.
- The vulnerability allows file modification, data access, and rogue admin account creation.
- Paulos Yibelo of pwn.ai discovered Click2Shell.
- Paulos Yibelo reported the vulnerability to WordPress on August 22.
- The vulnerability is a pre-authenticated remote code execution chain.
- A logged-in administrator must visit a crafted link for exploitation.
- The vulnerability is named Comment2Shell.
- The vulnerability is tracked as CVE-2026-93485.
- The flaw allows an anonymous user to plant a hidden script in a comment.
- WordPress released version 7.1.1 on September 17.
- Patchstack assigned the flaw a CVSS score of 7.1 out of 10.
- Rafie Muhammad reported the bug.
- The flaw involves a line break inside an allowed HTML tag attribute in a comment.
- WordPress patched 11 vulnerabilities.
- The flaw allows unauthenticated attackers to force installation of malicious themes.
- The vulnerability exists because a value in the theme-preview URL is interpreted differently by the themes API and JavaScript.
- The API reduces the value to an ordinary theme slug.
- The browser retains the original punctuation and places it inside a jQuery selector.
- The theme is fetched from the official WordPress.org catalog.
Vulnerability Description
WordPress has addressed a security vulnerability in its core software, identified as Click2Shell by security firm pwn.ai. This flaw enables an attacker to force the installation of a theme from the official WordPress.org directory on a site if a logged-in administrator opens a specially crafted web link. The theme is installed but remains inactive.
Attack Chain and Impact
While the core vulnerability only installs a legitimate theme, pwn.ai researchers demonstrated that it can be combined with a separate weakness in the installed theme to achieve remote code execution on the server. For example, the Mobile Repair Zone theme contained a flaw that allowed it to fetch and run code from a web address without proper authentication, enabling the full attack chain.
Technical Mechanism
The vulnerability exploits how WordPress processes URLs. The WordPress.org directory interprets a value in the link as a theme name, while the administrator's browser reuses the original text, including punctuation, to manipulate an internal script. This script then programmatically clicks the 'Install' button, leveraging the administrator's existing session and security token.
Severity and Patch
Pwn.ai rated the forced-install flaw as high severity (CVSS 7.1) and the full code execution chain as critical (CVSS 9.6). WordPress released a fix for this issue on September 17 in version 7.1.1 and recommends immediate updates due to its security implications. There is no indication that this vulnerability has been exploited in real-world attacks.
Updates
- WordPress patched 11 vulnerabilities.
- The flaw allows unauthenticated attackers to force installation of malicious themes.
- The vulnerability exists because a value in the theme-preview URL is interpreted differently by the themes API and JavaScript.
- The API reduces the value to an ordinary theme slug.
- The browser retains the original punctuation and places it inside a jQuery selector.
- The theme is fetched from the official WordPress.org catalog.
- The vulnerability is named Comment2Shell.
- The vulnerability is tracked as CVE-2026-93485.
- The flaw allows an anonymous user to plant a hidden script in a comment.
- WordPress released version 7.1.1 on September 17.
- Patchstack assigned the flaw a CVSS score of 7.1 out of 10.
- Rafie Muhammad reported the bug.
- The flaw involves a line break inside an allowed HTML tag attribute in a comment.
- Click2Shell is a cross-site request forgery (CSRF) vulnerability.
- The flaw affects WordPress 7.1.0 and earlier versions.
- The vulnerability allows file modification, data access, and rogue admin account creation.
- Paulos Yibelo of pwn.ai discovered Click2Shell.
- Paulos Yibelo reported the vulnerability to WordPress on August 22.
- The vulnerability is a pre-authenticated remote code execution chain.
- A logged-in administrator must visit a crafted link for exploitation.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
CVE CVE-2026-934857.1 HIGHHow outlets covered it
WordPress released patches for 11 vulnerabilities, including a critical 'Click2Shell' flaw that could lead to remote code execution (RCE). The 'Click2Shell' vulnerability allowed unauthenticated attackers to force the installation of malicious themes, which could then be exploited for RCE even while inactive, impacting WordPress sites.
A new WordPress core vulnerability, CVE-2026-93485 or "Comment2Shell," allowed an anonymous user to plant a hidden script in a comment, which could lead to remote code execution if an administrator viewed the page. WordPress released version 7.1.1 on September 17 to fix this flaw, urging site owners to update immediately. This vulnerability is significant because it demonstrates a path from unauthenticated input to server compromise through an administrative action.
A cross-site request forgery (CSRF) vulnerability, dubbed 'Click2Shell', in WordPress Core allowed attackers to install themes and execute arbitrary PHP code on affected servers. The flaw, present in WordPress 7.1.0 and earlier, was addressed with the release of WordPress version 7.1.1. This vulnerability could lead to file modification, data access, and the creation of rogue administrator accounts.
WordPress released patches for a vulnerability, dubbed Click2Shell by pwn.ai, that allows a logged-in administrator to install a theme from the official directory via a crafted web link. This flaw can be chained with a separate theme vulnerability to achieve remote code execution on the server.