Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

WordPress core Click2Shell security flaw

Vulnerability
First reported
Last updated
Happening score
H score 37
2 unique sources, 2 articles

Summary

Hide ▲

WordPress core’s Click2Shell vulnerability is a CSRF chain that can let a logged-in administrator open a crafted URL, force-install a theme from the WordPress.org catalog, and reach arbitrary PHP execution on the server when chained with a theme weakness. The flaw affects WordPress Core 7.1.0 and earlier and was fixed in WordPress 7.1.1 after WordPress shipped the patch on September 17, 2026. pwn.ai later published technical details and a proof-of-concept exploit, showing the chain can be used to force-install other vulnerable themes as well. The public write-up says attacks can be delivered through crafted links and may be triggered by phishing or an XSS condition that causes the administrator’s browser to send the request.

Related Happenings

WooCommerce Wholesale Lead Capture actively exploited arbitrary file-upload vulnerability (CVE-2026-27540)

Vulnerability
H score16 First: 15.09.2026 17:45 Last: 15.09.2026 17:45 Sources 1

About this happening: CVE-2026-27540 in the WooCommerce Wholesale Lead Capture WordPress plugin is being actively exploited, putting version 2.0.3.1 and older at risk of PHP webshell...

Open Happening

Avada/Fusion Builder zero-click RCE (CVE-2026-18431)

Vulnerability
H score44 First: 27.08.2026 00:33 Last: 27.08.2026 00:33 Sources 1

About this happening: CVE-2026-18431 is a critical 9.8 vulnerability chain in Avada and Fusion Builder that lets an unauthenticated attacker trigger arbitrary PHP code execution...

Open Happening

WordPress login screen pre-auth reflected XSS (CVE-2026-64638)

Vulnerability
H score24 First: 07.08.2026 15:56 Last: 07.08.2026 15:56 Sources 1

About this happening: WordPress patched CVE-2026-64638, a pre-auth reflected XSS in the login screen that affects every version of the CMS. The flaw can be chained under additional...

Open Happening

WordPress core pre-auth RCE flaw

Vulnerability
H score80 First: 18.07.2026 00:20 Last: 18.07.2026 00:20 Sources 1

About this happening: WordPress core's wp2shell chain combines CVE-2026-63030 and CVE-2026-60137 into unauthenticated remote code execution on vulnerable WordPress 6.9.x and 7.0.x...

Latest development: 20.07.2026 17:00

Searchlight Cyber’s Adam Kues used GPT5.6 Sol Ultra to develop WP2Shell, a multi-stage exploit chain against WordPress Core CVE-2026-63030 and CVE-2026-60137. The chain starts with REST API batch route confusion and SQL injection, then escalates through cache poisoning, WordPress customize changesets, authentication bypass, and backdoor plugin upload to reach pre-authentication remote code execution against WordPress 6.9.x and 7.0.x.

Open Happening

Timeline

  1. 21.09.2026 21:23 1 articles · 2h ago

    pwn.ai publishes Click2Shell exploit details and PoC

    Technical Analysis Update

    pwn.ai publishes technical details and a complete proof-of-concept for Click2Shell, a WordPress Core CSRF chain that can let a logged-in administrator open a crafted URL, force-install a theme from the WordPress.org catalog, and execute arbitrary PHP on the server. The write-up says the flaw affects WordPress Core 7.1.0 and earlier, and that the underlying issue can be leveraged to force-install other vulnerable themes as well.

    Show sources
    Open in new tab
  2. 18.09.2026 19:56 1 articles · 3d ago

    WordPress ships WordPress 7.1.1 to close Click2Shell

    Mitigation Patch Update

    WordPress shipped a security fix in WordPress 7.1.1 on September 17, closing the Click2Shell core flaw across supported branches back to 4.7 after researchers showed a crafted link opened by a logged-in administrator could force an inactive theme install from WordPress.org.

    Show sources
    Open in new tab
  3. 18.09.2026 19:56 2 articles · 3d ago

    pwn.ai details Click2Shell in WordPress core

    Initial Disclosure

    pwn.ai names Click2Shell as a WordPress core flaw where a specially crafted URL opened by a logged-in administrator can automatically install and preview an inactive theme from WordPress.org without clicking Install; WordPress says no CVE identifier has been assigned yet.

    Show sources
    Open in new tab