WordPress 7.1.1 shipped on 17 September with eleven security fixes. Coverage has settled on one of them, because it has a name, a research write-up and a satisfying attack chain.
It is worth understanding. It may also not be the fix your site needed most.
Click2Shell, briefly
pwn.ai and researcher Paulos Yibelo reported a flaw where a crafted link, opened by a logged-in administrator, causes WordPress to install a theme from the official WordPress.org directory without anyone clicking Install.
The mechanism is a disagreement between two components reading the same string:
1 Crafted theme-preview link 2 The Themes API canonicalises the value into a real catalog slug and returns a genuine theme 3 The browser reuses the original, unescaped value as a jQuery selector on the page 4 The attacker's added punctuation aims that selector at the Install control, and WordPress's own JavaScript clicks it 5 The theme is written to disk, still inactive 6 The Customizer preview loads the inactive theme's PHP 7 That theme's unprotected AJAX handler fetches and includes attacker-selected PHP 8 Server-side code execution
The administrator's session supplies the capability and the security token, so the attacker supplies neither.
Two details are worth carrying beyond this specific bug.
Inactive does not mean inert. The Customizer can load a theme's PHP before the theme is ever switched on. Anyone who has reasoned "I installed it but did not activate it, so it is fine" has been relying on something that is not true.
The severity of the core flaw is set by the worst theme in the directory. The core bug alone installs a real, official theme — pwn.ai is explicit that it "does not accept an arbitrary theme ZIP by itself." What turned it into code execution was a second flaw in the theme the attacker chose, in that case an AJAX handler that downloaded and ran a package with no permission check. The attacker picks from the whole catalogue. The core bug's real-world severity is therefore whatever the weakest theme available in WordPress.org happens to be, which is not a number anyone can publish.
The researchers scored the forced install at 7.1 and the full chain at 9.6. WordPress published no severity rating and described the issue as: specially crafted URLs can automatically install and preview an inactive theme from WordPress.org. Both statements are accurate. Only one of them tells you what happens next.
No CVE identifier has been assigned yet.
A public proof-of-concept already exists. A repository reconstructing the chain appeared on GitHub after disclosure. Its author notes the exact selector strings were templated because the disclosure's code blocks did not render in the copy they worked from — but the verbatim strings are in the original write-up. Treat the exploitation window as open.
The one with no login requirement
Click2Shell needs a logged-in administrator to open a link. That is a real barrier, and it is why WordPress reports no sign of exploitation.
Elsewhere in the same release is a stored cross-site scripting flaw in wpautop(), reported by Rafie Muhammad of Awesome Motive, which lets an unauthenticated visitor inject script — subject to comment approval. That is the lowest authentication barrier of anything in the release.
If your site accepts comments and someone approves them, that is a shorter path than a targeted link sent to an administrator who has to be logged in and has to click.
The rest of the eleven include an authenticated path traversal in the REST templates controller, a Contributor-level arbitrary post overwrite, an XML-RPC bypass that publishes customize_changeset posts without the edit_css capability check, a stored XSS in custom header images, an HTML API issue letting modified text escape a comment, a multisite privilege issue, a private parent-post title disclosure, a draft and pending slug disclosure, and an authorisation issue allowing any authenticated user to reparent comments.
None of them have names. Several are reachable by a contributor account, which on a site with guest authors is not a high bar.
What to actually do
- Update to 7.1.1. Dashboard, Updates, or from WordPress.org. Sites with automatic background updates will receive it on their own — confirm rather than assume.
- If you run an older branch, fixes were backported as far back as 4.7. Install the matching update, then plan to move. Only the latest release is actively supported, and "patched on 5.9" is a position that expires.
- Check your installed themes list, not your site's appearance. The point of Click2Shell is that nothing visible changes. An inactive theme you do not remember installing is the artefact.
- Review who holds Contributor and above. Several fixes in this release are reachable from that level, and most sites have accounts at that level that nobody has looked at in years.
- Do not conflate this with wp2shell. That is a separate WordPress core flaw disclosed in July, unrelated to pwn.ai's work, requiring no login and no click — and CISA has listed it as exploited in real attacks. If you have not patched for that one, it is more urgent than anything here.
The pattern in the middle of this
This is the second WordPress core flaw pwn.ai has reported in recent weeks, after a similar chain through the login screen in August. In both cases the researchers described the risk more broadly than WordPress did.
Neither description is wrong. The vendor documents what the core defect does; the researchers document what it does when combined with the environment it lives in. A site owner reading only the release note gets an accurate sentence and an incomplete picture.
We have written some version of this four times this month — an advisory with no CVE, release notes that do not mention the security fix they contain, a vendor describing a flaw more narrowly than the finder. The practical conclusion is the same each time: the release note tells you to update, and that is the only part of it you should act on without reading further.
4Tify reviews web platform exposure, including the plugin and theme inventory nobody has audited since launch. If you want yours assessed, get in touch.