WordPress 7.1.1 Closes the Click2Shell Remote Code Chain

A WordPress vulnerability chain patched Sept. 17 let an attacker reach server-side code execution with a single clicked link, provided the target was a logged-in site administrator and the site had not disabled theme installation from the dashboard.

WordPress credited the finding, which researcher Paulos Yibelo of the security firm pwn.ai calls Click2Shell, in the release notes for version 7.1.1, one of 11 security fixes in that update, according to WordPress's own announcement.

How a theme slug becomes a fake click

WordPress's theme-preview feature takes a theme slug as a URL parameter. The server checks that slug against the WordPress.org Themes API before acting on it. The frontend does not: its JavaScript drops the raw parameter straight into a jQuery selector string with no sanitization first. A slug built to break out of that selector string can make the page believe the visitor clicked "Install" on a theme the visitor never chose, according to Patchstack's technical write-up of the chain.

A theme with no nonce and no capability check

Yibelo's proof of concept used that selector injection to silently install a real, published theme, Mobile Repair Zone 2.5.4, then sent a second crafted link that opened the new theme inside WordPress's Customizer preview. Loading the preview runs the theme's functions.php, and that file shipped with an AJAX handler that accepted a plugin-download URL and executed it on the server, protected by no nonce check and no capability check, Patchstack found. Chained together, the two flaws let an attacker's own URL run with the same authority as the logged-in administrator who loaded the link.

What the attack needs, and what stops it

The chain only fires if a logged-in administrator loads the crafted link, or if the site already carries an unrelated cross-site-scripting bug an attacker can substitute for that click, and it fails outright on any installation whose wp-config.php sets the DISALLOW_FILE_MODS constant, which blocks theme and plugin installation from the dashboard entirely. Sites that disable in-dashboard installs for change-management reasons were never exposed to it.

The fix, and what else shipped alongside it

The patch runs the slug through jQuery's own $.escapeSelector() function before it reaches the selector, so a crafted value is treated as literal text rather than selector syntax. Version 7.1.1 fixed 10 other security issues in the same release, credited to a mix of WordPress's own security team and outside researchers including Rafie Muhammad of Awesome Motive and Justin Hart of Viridis Security, alongside 17 unrelated Core bug fixes and 19 in the Block Editor.

1. Security fixes11 fixes
2. Core bug fixes17 fixes
3. Block Editor fixes19 fixes

Source: WordPress.org, "WordPress 7.1.1 Maintenance and Security Release," accessed 2026-09-21

Click2Shell joins a path-traversal bug GitLab patched and a template-injection flaw in Forgejo as the latest self-hosted web tool this month to reach code execution through content that was supposed to be inert. WordPress assigns no CVE number to Click2Shell or to any other fix in this release, so vulnerability trackers built on the National Vulnerability Database will not surface the chain under any identifier. Administrators confirming they are covered should check for version 7.1.1 on the Dashboard's Updates screen rather than search a CVE feed for it.