A security researcher has disclosed a pre-authentication remote code execution vulnerability in WordPress core, nicknamed “Click2Shell,” that allows an attacker to install a theme from the official WordPress.org catalog and execute arbitrary PHP files on the target website — without ever logging in. WordPress fixed the flaw with the release of version 7.1.1 last week.
The bug was discovered by Paulos Yibelo of autonomous penetration testing platform pwn.ai, who reported it to WordPress on August 22. The flaw stems from a double-interpretation problem: a value in a WordPress theme-preview URL is parsed once by the WordPress.org Themes API and a second time — differently — by JavaScript running in the administrator’s browser. That mismatch lets an attacker silently add a theme to a target site without the administrator ever explicitly installing it. Crucially, even an inactive theme can execute PHP during a Customizer preview, completing the RCE chain. The attack still requires a logged-in administrator to visit a specially crafted URL, so some degree of social engineering — a phishing email, a disguised link in a forum — is part of any real-world exploitation. A proof-of-concept exploit has already been published by the researcher.
How to check if you’re affected
Affected versions include all WordPress installations running versions before 7.1.1. Log in to your WordPress dashboard, go to Dashboard → Updates, and install the latest release. Hosting providers that manage WordPress automatically (WP Engine, Kinsta, Pressable, and similar) will have already applied the patch; check your site’s version string in the admin footer or via wp core version in WP-CLI to confirm.