Click2Shell: One-Click Chain from Automatic WordPress Theme Installation to PHP Execution

wpnews.pro

#

Basic Information

Original Title: Click2Shell: Preauth WordPress Core Theme Preview Injection to RCE Chain

- Release Date: 2026-09-18
- Collection Date: 2026-09-22T08:00:36+09:00

**Source** :[pwn.ai](https://pwn.ai/blog/click2shell)
- Severity: High

Basis for Severity: The official CVSS score for the WordPress Core issue alone is 5.3 (Moderate). However, when chained with a vulnerable theme, visiting a malicious URL as an administrator leads to arbitrary PHP execution on the server. Because multiple conditions and user interaction are required and active exploitation in the wild has not been reported, the overall severity is rated as High.
Related Source: BleepingComputer: WordPress Click2Shell flaw lets hackers execute PHP on the server

- Related Source: [WordPress 7.1.1 Maintenance and Security Release](https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/)
- Related Source: [WordPress Security Advisory GHSA-5qf7-2r5p-ppj8](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-5qf7-2r5p-ppj8)
- CVE: None

Target Products and Services: WordPress Core 7.1.0 and affected releases in branches 7.0 through 4.8 as listed in GHSA-5qf7-2r5p-ppj8, Mobile Repair Zone 2.5.4, and WordPress Customizer
Threat Actor: Unidentified

When an administrator opens a crafted URL, a WordPress Core selector injection automatically installs and previews a theme from the official WordPress.org catalog without requiring the administrator to click Install or Activate. Furthermore, in a research PoC that chains this with another vulnerability in the pre-activation process, it reaches arbitrary PHP execution.

#

Attack Flow

Click2Shell Full Chain

While the WordPress Themes API normalizes the input to a regular slug, the attacker crafts a URL that is reinterpreted as a jQuery selector in the administrator's browser.
When the administrator opens the URL and logs in if necessary, WordPress JavaScript automatically clicks the legitimate install control, installing an official catalog theme while keeping it inactive.
The attacker-controlled page then submits a follow-on request to admin-ajax.php with the Customizer parameters, causing the inactive theme’s functions.php to load.
The vulnerable theme's AJAX handler fetches, extracts, and includes an attacker-specified plugin ZIP, executing PHP under the WordPress server account.

#

Attacker Positioning and Execution Location

The attacker does not possess a WordPress account and lures the administrator to the crafted URL from an external web page or message.
The final payload executes with the privileges of the PHP worker on the WordPress server.

#

Victim and Administrator Perspective

Victim

When opening a crafted link, it looks like a normal WordPress login screen or theme preview, making it difficult to notice that a theme has been automatically installed.

Administrator

Clues include new directories for unapproved themes, the Customizer preview, plugin ZIP retrieval from external URLs, and new code by the PHP worker.

#

Conditions for Success and Failure

Success Conditions

Using WordPress Core 7.1.0 or an affected release in branches 7.0 through 4.8 as listed in GHSA-5qf7-2r5p-ppj8, where the administrator opens a crafted URL and logs in if necessary.
Full RCE requires another vulnerable theme that loads during preview and allows the introduction of an attacker-specified plugin.

Failure Conditions

Updating to the patched version corresponding to the active branch. The fix was backported to branches from 7.1 through 4.8. Patched releases include 7.1.1, 7.0.5, 6.9.8, and 4.8.31. Upgrade to the latest supported WordPress version whenever possible.
Removing unnecessary themes and restricting plugin and theme installation via file permissions, WAF, and outbound traffic controls.

#

Impact Upon Success

Progresses to arbitrary PHP execution, modification of WordPress settings, content, and users, and reading wp-config.php or database credentials.
Impact can spread to files and secrets on the host accessible to the same service account.

#

Observable Logs

Email : No actual instances of email being used for luring have been reported. If a suspicious URL is received, verify the sender and click time. #

Proxy / SWG / DNS : Check for theme queries in theme-install.php, wp_customize in admin-ajax.php, and HTTP/DNS requests to external plugin ZIPs. #

Endpoint / EDR : Check for new writes to wp-content/themes and plugins, child processes of the PHP worker, and access to wp-config.php. #

Identity / IdP : Check administrator session usage times and unusual IP addresses or devices. #

SaaS / Cloud : Check for changes to WordPress DB users, options, and content, and abnormal operations on the hosting control plane. #

Network : Check for communications from the WordPress host to unknown download sources or C2 servers.

#

Success Determination

Confirmed via Public Information

RCE Chain Confirmed in Research Environment : pwn.ai verified arbitrary PHP execution by chaining WordPress Core's automatic theme installation and preview with another vulnerability in Mobile Repair Zone 2.5.4. #

Exploitation in the Wild Unconfirmed : Public information reports no real-world attacks, compromised sites, or deployed payloads.

Internal Organization Criteria

Confirm User Interaction : Check browser history or proxy logs to verify if an administrator opened a crafted URL and reached theme-install.php. #

Confirm Initial Execution : Verify the creation of new theme/plugin files and the execution of plugin code by the PHP worker. #

Confirm Subsequent Compromise : Substantiate unauthorized users, content tampering, credential access, additional payloads, or outbound communications.

#

Investigation Playbook

Trigger : Triggered by suspicious theme-install.php/Customizer access by a WordPress administrator or the addition of unapproved themes and plugins. #

Initial Checks : Verify Core/theme versions, administrator sessions, request logs, installed themes/plugins, and file timestamps. #

Endpoint : Preserve the wp-content directory, PHP process tree, and web server/PHP/WAF logs. #

Identity / Cloud : Check usage history for WordPress administrators, databases, hosting, and cloud credentials. #

Follow-on Activity : Search for web shells, scheduled tasks, unauthorized users, modified content, and external communications. #

Classification : Categorize URL visits, automatic theme installation, inactive theme , PHP execution, and subsequent compromise.

#

Detection Ideas

Single Event : Detect requests where the theme value in theme-install.php contains encodings indicating quotes, combinators, or comments. #

Time-Series Correlation : Correlate administrator URL visits, theme directory creation, Customizer AJAX calls, external ZIP retrieval, and PHP execution within a short timeframe. #

Hunting : Search for unapproved inactive themes, plugin entry points, recent files in wp-content, and admin-ajax actions. #

Log Gaps : Web access logs alone will miss PHP inclusions and file writes, making file integrity and process telemetry necessary. #

Priority Controls : Prioritize updating to the patched version of the used branch or the latest WordPress, removing unnecessary themes, minimizing installation privileges, and controlling PHP outbound communication.

#

Facts / Inference / Hypothesis

Facts

WordPress released version 7.1.1 on September 17, 2026, and subsequently provided patched versions for affected branches up to version 4.8 in official advisories. The Core issue has a CVSS score of 5.3 (Moderate). pwn.ai published technical details on September 18.
The Core issue allows an unauthenticated attacker to cause a logged-in administrator’s site to install an attacker-selected theme from the official WordPress.org catalog without any further clicks after the crafted URL is opened.
Full RCE verification chains the property where PHP is loaded during Customizer preview even for inactive themes with a plugin installer vulnerability lacking nonce and capability checks in Mobile Repair Zone 2.5.4.
An attacker WordPress account is not required, but administrator URL visitation and login (if unauthenticated) are needed. Active exploitation in the wild has not been reported.

Inference

This is a confused-deputy and CSRF-like chain: attacker-controlled selector data causes trusted administrator-side JavaScript to invoke a nonce-protected theme installation action, while the theme’s separate AJAX handler lacks nonce and capability checks.

Hypothesis

No additional hypotheses. Unverified items are listed under "Unknowns and Further Investigation".

#

MITRE ATT&CK

T1189 Drive-by Compromise (Confidence: High): Initiated by a logged-in administrator opening a crafted management URL from an attacker's page.
T1190 Exploit Public-Facing Application (Confidence: Medium): Executes PHP on the WordPress server via a vulnerability chain in Core and themes.

#

Unknowns and Further Investigation

The CVE identifier for the Core issue and any separate identifiers or official severity ratings for the vulnerable theme-side installers.
An exact list and remediation status of over 40 themes possessing similar pre-activation installers other than Mobile Repair Zone.
The presence of active exploitation in the wild, attack URLs, or deployed payloads.

#

Impact on SOCs and Organizations

WordPress is widely used for public-facing websites worldwide. In addition to updating to the patched version of the used branch or the latest WordPress, organizations must correlate paths where administrators are lured to the admin panel from external links, additions of inactive themes, plugin ZIP retrievals, and outbound communications from PHP workers, verifying theme-side permission checks in addition to Core updates.

#

Summary by Role

SOC : Verify administrator external URL visits, crafted queries to theme-install.php, theme additions, Customizer previews, plugin ZIP retrievals, and PHP execution within the same timeline. #

Administrator : Update to the patched version of the used branch or the latest WordPress, remove unnecessary themes, and restrict installation privileges and outbound communications for themes and plugins. #

User : Do not open unsolicited theme-preview or WordPress administration links while logged in to the WordPress admin panel.

source & further reading

dev.to — original article A PR walkthrough needs evidence between the steps Gemini Accessed Three Real Companies During a Security Evaluation via Password Guessing and Publicly Exposed Credentials I built a gomoku arena where AI agents play each other over MCP