'Click2Shell' CSRF forces theme install and chains to server-side PHP execution, public PoC (WordPress Core)
A complete PoC and technical write-up became public on 2026-09-21, four days after the 7.1.1 fix shipped, and independent analysis from Patchstack has reproduced the chain; sites still on 7.1.0 or earlier with an admin who clicks a link are now exposed to a weaponizable server-side RCE.
Researcher Paulos Yibelo of pwn.ai published full technical details and a proof-of-concept exploit for 'Click2Shell', a cross-site request forgery flaw in WordPress Core 7.1.0 and earlier. A value from a theme-preview URL is parsed differently by the WordPress.org Themes API and by JavaScript in the administrator's browser, letting an attacker with no account, no nonce and no privileges force a site to install any theme from the official WordPress.org catalog. Because an inactive theme can still execute PHP during a Customizer preview, chaining the forced install with a vulnerable catalog theme yields arbitrary PHP execution on the server — enough to read wp-config.php database credentials, create rogue admins, or plant backdoors. The attack does require a logged-in administrator to visit a crafted link (phishing, or via an existing XSS); Author and Editor accounts cannot trigger it. WordPress fixed the flaw in 7.1.1 (released 2026-09-17) by escaping the theme slug and restricting the jQuery selector to real theme cards. No CVE has been assigned yet; pwn.ai says WordPress plans to add one. No exploitation reports are known at this time.
Affected: WordPress Core 7.1.0 and earlier; fixed in 7.1.1
How to Test
Check your version in Dashboard > Updates or with `wp core version`; anything at 7.1.0 or below is affected. Check whether `DISALLOW_FILE_MODS` is set in wp-config.php (`grep DISALLOW_FILE_MODS wp-config.php`). Indicators of a past attack: unexpected themes in Appearance > Themes or under wp-content/themes/ that no administrator installed, Customizer/theme-preview requests in web server logs referencing theme slugs your team never chose, new or unfamiliar administrator accounts, and modified files under wp-content or changes to wp-config.php.
How to Patch
Apply the WordPress 7.1.1 update via Dashboard > Updates or `wp core update`, then verify with `wp core version`. Remove any themes you did not install. As an interim control set `define('DISALLOW_FILE_MODS', true);` in wp-config.php. Rotate database credentials and salts in wp-config.php if you find evidence of an unexpected theme install.