New Word Press Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution

Summary: WordPress released version 7.1.1 on September 17 to fix a core flaw that lets a crafted link, opened by a logged-in administrator, install a theme from the WordPress.org directory without anyone clicking Install; researchers at pwn.ai, who reported it, call the chain Click2Shell. The forced-install flaw alone was rated high severity at CVSS 7.1, and chaining it with a separate flaw in the installed theme Mobile Repair Zone - a background handler that fetched a web address, downloaded a package and ran its code without checking permission or a security token - reached code execution at CVSS 9.6.
Bottom line: The installed theme stays switched off, so the site's appearance does not change and nothing looks wrong, and the attack needs no credential or token from the attacker because the administrator's own session supplies both. WordPress has assigned no CVE yet and published no severity rating of its own, describing the issue only as crafted URLs that can automatically install and preview an inactive theme.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026