WordPress 7.1.1 Patches Click2Shell: One Link Installs a Theme

WordPress shipped version 7.1.1 on September 17, 2026, a combined maintenance and security release that the project says carries 17 Core bug fixes, 19 Block Editor fixes and 11 security fixes. One bullet in that list reads: "Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and pwn.ai."

A day later, on September 18, the security firm pwn.ai published its technical writeup and gave the bug a name: Click2Shell. In pwn.ai's account, the problem is that two pieces of software read the same link differently. The WordPress.org Themes API reduces the value in a theme-preview URL to an ordinary catalog slug and returns a genuine theme. The administrator's own browser keeps the original punctuation and drops it into a jQuery selector, and characters the attacker adds steer WordPress's own JavaScript into triggering the Install control. Because the administrator is already signed in, their session supplies both the permission and the security token. pwn.ai says the installed theme stays switched off, so the site's appearance never changes.

Reaching code execution took a second flaw. An inactive theme is not dormant: WordPress can load a theme's PHP while building a Customizer preview. The theme pwn.ai used, Mobile Repair Zone 2.5.4, registered a background handler that, in the firm's words, worked "without a nonce or capability check, accepted an attacker-selected plugin package URL, unpacked it, and loaded its PHP." Chained after the forced install, that handler ran the researchers' code on the server.

The two sides have not converged on how severe this is. pwn.ai rated the forced install on its own as high, CVSS 3.1 7.1, and the full demonstrated chain as critical, CVSS 3.1 9.3, noting that the required user interaction lowers the impact. The Hacker News reported the researchers' full-chain figure as 9.6. WordPress has published no severity rating of its own. No CVE identifier existed at disclosure; pwn.ai says WordPress told it one is coming. The Hacker News reported no sign the flaw has been used in real attacks.

WordPress fixed the selector in changeset 63664 by escaping it. The project says the security fixes are being backported where necessary to every branch still eligible for them, currently back to 4.7, and that those backports "are in progress and will ship as they become ready" - so some owners of sites on older branches are still waiting. According to The Hacker News, neither WordPress nor pwn.ai offered a separate workaround, and the attack still requires a logged-in administrator to open the link; updating core is the fix. pwn.ai reported the bug on August 22 and received WordPress's maximum bounty, $300. The firm said the work was done with "our custom harness, Claude Opus 5 and a human collaborating."

Disclosure: NewUJ's editorial process uses Anthropic's Claude models.