Threat Intelligence

WordPress Patches 'Click2Shell' Flaw That Could Let Attackers Hijack Admin Sessions

The Hacker News · 19 Sept 2026

Key Takeaway Update WordPress to version 7.1.1 or later as soon as possible, and review installed themes for known vulnerabilities to reduce the risk of this flaw being chained into a full compromise.

WordPress has released a security update fixing a vulnerability dubbed 'Click2Shell' by researchers at pwn.ai. The flaw could allow a specially crafted link, if opened by a logged-in site administrator, to silently install a theme from the official WordPress.org directory, without the admin clicking any install button themselves.

On its own, the bug only installs a legitimate theme chosen by the attacker, and the site's appearance does not change since the theme stays switched off. However, researchers demonstrated that if the installed theme has its own separate security weakness, attackers could chain the two flaws together to run their own malicious code on the server. This happened because the administrator's active login session unknowingly provided the permissions and security token needed to complete the install.

The issue was fixed on 17 September in WordPress version 7.1.1. WordPress has urged all site owners to apply the update immediately, as is standard for security releases. There is currently no evidence that this vulnerability has been exploited in real-world attacks.

WordPress vulnerability website security patch management small business cybersecurity

Summarised by CISO AI from The Hacker News. We link back to every original so you can read it yourself.