Your site can look completely normal while an attacker installs the pieces for a takeover — no failed login, no defaced page, just one admin clicking one link.
On September 17, 2026, WordPress shipped version 7.1.1, a security and maintenance release with 17 Core bug fixes, 19 Block Editor fixes, and 11 security fixes (WordPress, Sep 17, 2026). One bullet in that list matters more than the rest for shop owners: "Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org," reported by Paulos Yibelo and pwn.ai. Researchers call it Click2Shell. On its own it silently installs an attacker-chosen theme. Chained with a real theme flaw, it becomes remote code execution on your server — rated Critical at CVSS 9.3 by the researchers (pwn.ai, Sep 2026; WordPress has not published a final severity). There is no CVE identifier yet; WordPress has said one will be assigned soon. WordPress paid its maximum bug-bounty award for the report, with no dollar amount disclosed in the primary write-up. If you run WordPress, this is the update to apply first and verify second.
What happened
WordPress lets an admin preview or install themes straight from the WordPress.org catalog without leaving wp-admin. That flow passes a theme slug through the URL, and the same value gets read twice by two different pieces of code that handle it differently (Patchstack, Sep 18, 2026).
On the server side, the WordPress.org Themes API sanitizes the value. Extra characters get stripped, so a crafted value collapses to an ordinary slug like twentytwenty by the time the API responds. On the frontend, wp-admin JavaScript drops the same raw value directly into a jQuery selector string without sanitization. That mismatch is the whole vulnerability. A crafted slug tricks the preview page into thinking the viewer clicked Install on a completely unrelated theme — WordPress's own script effectively clicks it for them (Patchstack, Sep 18, 2026; pwn.ai, Sep 2026).
The result: an unauthenticated attacker can force a logged-in admin's site to download and install an attacker-selected theme from the official catalog. The admin never presses Install or Activate. The installed theme stays inactive, so the site looks unchanged throughout (pwn.ai, Sep 2026).
An inactive theme is usually inert — with one exception. WordPress loads a theme's PHP during a Customizer preview even while another theme remains active. pwn.ai's full chain used Mobile Repair Zone 2.5.4, a real catalog theme, as the second stage. Its code registered an AJAX handler with no nonce check and no capability check at all. That handler accepted a plugin download URL, treated an attacker-owned ZIP as a regular plugin, downloaded it, unpacked it, and executed it server-side (pwn.ai, Sep 2026; Patchstack, Sep 18, 2026).
Put together, one crafted link can make WordPress install the catalog theme, load that inactive theme through the Customizer, reach its unprotected installer, write an attacker-selected plugin package, and execute PHP under the WordPress server account. No attacker WordPress account is needed — just a single visit from a logged-in user (pwn.ai, Sep 2026). The researchers note more than 40 third-party catalog themes carried similar pre-activation code patterns, so Mobile Repair Zone is the demonstration, not the boundary.
The timeline is short. The core preview behavior was reported to WordPress on August 22, the full pre-activation chain was shared on September 1, the patch landed September 17, and technical write-ups went public September 17–18 (secondary coverage via The Daily Tech Feed, Sep 2026; pwn.ai, Sep 2026). Researchers rate the standalone forced install at CVSS 7.1 High and the full chain to code execution at CVSS 9.3 Critical (pwn.ai, Sep 2026; WordPress has not published a final severity). At disclosure there was no evidence of in-the-wild exploitation — which is exactly the window when patching matters most (pwn.ai, Sep 2026).
Two scope facts matter. Click2Shell is expected to affect all versions of WordPress before 7.1.1 (pwn.ai, Sep 2026); the fix is in 7.1.1, with security fixes backported where necessary to all branches eligible for security fixes, currently back to 4.7 (WordPress, Sep 17, 2026). And the same 7.1.1 release also fixes CVE-2026-93485, a stored cross-site scripting flaw in core wpautop() — the function that turns line breaks into paragraphs on nearly every install — where an unauthenticated visitor can carry the payload in a comment (subject to comment approval), rated 7.1 High by Patchstack as CNA (WordPress, Sep 17, 2026; Suriq, Sep 18, 2026).
Why this matters to website owners
For a shop owner, the uncomfortable part is how little this attack looks like an attack. There is no brute-force login spike, no strange checkout error, no changed homepage. An admin opens what looks like a routine preview link — from email, chat, or a support thread — and behind the scenes WordPress installs a theme and exposes a path to code execution. A successful compromise can expose wp-config.php and database credentials, read WordPress or WooCommerce data, alter files and content, create users, steal secrets available to the PHP worker, and potentially reach further into the hosting environment (cybersecuritynews.com, Sep 2026).
Three things make this pattern worse than a typical plugin bug.
First, the target is core, not a plugin you can simply delete. Click2Shell lives in WordPress itself, so every unpatched site on an affected branch is in scope regardless of which plugins it runs. With WordPress powering about 43% of the web — an estimated 500 million sites — a core flaw puts nearly half of all sites at risk at once (pwn.ai, Sep 2026).
Second, the human step is ordinary. Admins click links all day: theme demos, staging previews, client feedback, vendor docs. This chain needs exactly one logged-in click. That makes email and chat hygiene part of server security, not just inbox etiquette.
Third, this summer already showed what happens when a core chain goes unpatched. July's wp2shell chain (CVE-2026-63030, CVSS 9.8, plus CVE-2026-60137) gave unauthenticated attackers remote code execution on stock installs, was added to CISA's Known Exploited Vulnerabilities catalog on July 21, 2026, and has since drawn tens of thousands of attacking IPs — CrowdSec tracked 62,802 in its observation window (Rapid7, Jul 2026; CrowdSec, Aug 2026; Greenbone, Aug 2026). Fixed in 6.9.5, 7.0.2, and 6.8.6 at the time, it is now actively exploited in the wild. Click2Shell is at the earlier point on that same curve: patch published, details public, no exploitation reported yet. That is the moment to close the window.
The companion fix in the same release reinforces the point. CVE-2026-93485 rides in through comments — the most ordinary surface a small business site has. On sites that auto-approve comments, a stored payload fires sooner; on moderated sites, it fires after approval (Suriq, Sep 18, 2026). One release, two reminders: update core, and treat everyday inputs as security boundary.
What to do
Update WordPress to 7.1.1 or your branch backport now. This is the fix. In wp-admin go to Dashboard → Updates and apply 7.1.1, or the corresponding backported release if your site tracks an older branch (WordPress supports security backports to 4.7). Then confirm the version actually changed — do not assume background updates applied it. Sites with auto-updates disabled, file permissions that block core from writing to itself, hosts that manage updates on their own schedule, or modified core files can all miss an automatic rollout. The reason update comes first is that it closes both Click2Shell and the wpautop() stored XSS in one move — everything below is verification, not a substitute.
Verify automatic updates are really on. After updating, check that automatic background updates for minor core releases are enabled, and confirm with whoever maintains the site or hosting plan who applies core updates and on what schedule. Unpatched WordPress sites are being hit right now by the older wp2shell chain, which is already in CISA KEV — a site that missed 7.0.2 is the same site most likely to miss 7.1.1 (Rapid7, Jul 2026).
Treat admin links as privileged. Until and after patching, do not open theme preview, Customizer, or wp-admin links from email or chat without verifying the sender through a second channel. If someone sends a preview URL, ask them to confirm it in the project thread or by phone before opening it while logged in. The reason is structural: this chain converts one authenticated click into installation, so reducing untrusted clicks while logged in shrinks the reachable window.
Prune unused themes and plugins. Remove themes and plugins the site does not use, and keep the rest updated. The demonstration chain needed a vulnerable second-stage theme; the researchers found dozens of catalog themes with the same pre-activation pattern. Fewer installed themes means fewer second stages for the next chain. This does not fix Click2Shell by itself — only the core update does — but it lowers what any forced install can reach.
Work the comment queue because of CVE-2026-93485. Open the moderation queue and purge anything carrying script markup. Hold off on bulk-approving comments until core is patched, and reconsider auto-approve settings for first-time commenters. The flaw needs no privileges but fires when the comment renders, so a tightened queue is a real control during the patch window (WordPress, Sep 17, 2026; Suriq, Sep 18, 2026).
Check for signs of use, then get a review if anything looks off. Ask your host or developer to look for themes installed around September 17–19 that nobody on your team added, unfamiliar admin users, unexpected PHP files or plugins, and suspicious requests to theme-install or Customizer/admin-ajax.php endpoints. Matches confirm probing or worse; the absence of matches does not prove the site is clean, because logs rotate and attackers vary paths — which is why the update and the theme inventory above matter more. If anything unfamiliar turns up, treat it as an active incident and get a focused security review rather than stopping at deletion.
Key numbers
- 7.1.1 released September 17, 2026 — 11 security fixes, 17 Core bug fixes, 19 Block Editor fixes — WordPress, Sep 17, 2026.
- Click2Shell: crafted URLs auto-install and preview an inactive WordPress.org theme — no CVE at release, CVE pending; maximum bounty paid — WordPress, Sep 17, 2026; pwn.ai, Sep 2026.
- CVSS 7.1 High standalone (forced install) / CVSS 9.3 Critical full chain to RCE — pwn.ai, Sep 2026; WordPress has not published a final severity.
- Affected: all WordPress versions before 7.1.1 (pwn.ai expects all pre-7.1.1 affected); fixed: 7.1.1 with backports to 4.7 — pwn.ai, Sep 2026; WordPress, Sep 17, 2026.
- Attack needs: one click by a logged-in admin; no attacker account; installed theme stays inactive — pwn.ai, Sep 2026.
- Second stage demoed with Mobile Repair Zone 2.5.4 (AJAX handler, no nonce/capability check); 40+ catalog themes shared the risky pre-activation pattern — pwn.ai, Sep 2026.
- CVE-2026-93485 in same release: stored XSS in core
wpautop()via unauthenticated comment (subject to approval), CVSS 7.1 High — WordPress, Sep 17, 2026; Suriq, Sep 18, 2026. - Context: wp2shell (CVE-2026-63030 CVSS 9.8 + CVE-2026-60137) added to CISA KEV July 21, 2026; 62,802 attacking IPs observed; fixed in 6.9.5 / 7.0.2 / 6.8.6 — Rapid7, Jul 2026; CrowdSec, Aug 2026.
- Scale: WordPress powers ~43% of the web, ~500M sites — pwn.ai, Sep 2026.
Final takeaway
Click2Shell turns an everyday admin habit — opening a preview link — into silent theme installation, and with the wrong theme installed, into a server shell. WordPress 7.1.1 closes it, backported to 4.7, alongside a core comment XSS that deserves the same update. Apply the release, confirm it actually landed, trim what you do not use, and keep the comment queue tight until you have. That is an afternoon of work that converts this month's highest-blast-radius WordPress exposure into a verified non-event.
Is your site ready? Run a free security scan — 40+ automated checks, instant results, no commitment.