Click2Shell Flaw in WordPress Core Enables Remote Code Execution via Single Malicious Link
Researchers at pwn.ai have disclosed Click2Shell, a vulnerability in the WordPress core that allows an attacker to install a malicious theme and achieve remote code execution simply by tricking an authenticated administrator into opening a crafted link. The isolated flaw carries a CVSS score of 7.1, but the full attack chain reaches 9.6. The issue stems from an interpretation mismatch between the WordPress.org theme directory and the administrator browser, causing the browser to automatically trigger the install button without any user confirmation or password prompt. Affected versions start from 6.0 and run up to but not including 7.1.1. The vulnerability has been fixed in WordPress 7.1.1 with backported patches released for all supported branches down to version 4.7. No exploitation in the wild had been observed at the time of disclosure, yet the low barrier of convincing an admin to click a link makes prompt patching essential.
BoletimSecSep 21, 2026Translated from Portuguese