Click2Shell: The Public WordPress PoC That Turns One Admin Click Into Server Root

The flaw

A pre-authenticated remote code execution chain in WordPress Core now has full technical details and a working proof-of-concept in public. It goes by “Click2Shell,” and BleepingComputer wrote it up on September 21. The good news is that it’s already fixed, in version 7.1.1. The bad news is that most of the internet’s WordPress installs are behind, and the exploit asks nothing of the attacker: no account, no nonce, no credentials.

The researcher behind it is Paulos Yibelo of pwn.ai, an autonomous penetration testing platform. He reported the bug to WordPress on August 22, and a fix shipped roughly three weeks later. There is no CVE identifier assigned yet, which tells you the disclosure was coordinated rather than leaked. That coordination window is closed now.

How the chain works

The bug is a cross-site request forgery with an unusual twist. A value from a WordPress theme-preview URL gets interpreted twice: once by the WordPress.org Themes API, and a second time, incorrectly, by JavaScript in the administrator’s own browser.

That second interpretation is where the damage happens. The theme slug lands inside a jQuery selector without being escaped, and the admin’s browser ends up triggering a theme installation on their own site without anyone approving it. Any theme in the official WordPress.org catalog can be force-installed this way.

Installation alone would be half the story. Yibelo found that even an inactive theme still executes PHP during a Customizer preview. So the attacker picks a catalog theme whose code runs server-side, the admin’s browser installs it, the preview renders, and the attacker’s PHP is now running on your web server.

The catch: someone with keys has to click

For all the “pre-authenticated” language, the chain has one human requirement. A logged-in administrator has to visit a crafted URL. Patchstack, which analyzed the flaw, confirmed that only the Administrator role can trigger it. Author and Editor accounts lack the permission to install themes, so they can’t set the chain off.

The realistic delivery paths, per Patchstack: targeted phishing aimed at whoever holds admin access, or an existing cross-site scripting bug on the site that makes the admin’s browser fire the request without them ever leaving the dashboard. Neither is exotic. A helpdesk-style email telling a site owner to “review this preview link” is precisely the kind of message an admin answers.

What the attacker gets

Once PHP runs on the server, that box belongs to the attacker. The demonstrated impact includes:

• Reading, modifying, and deleting files on the server
• Grabbing wp-config.php, which holds database credentials and authentication salts
• Creating rogue administrator accounts that survive until you happen to find them
• Injecting malicious scripts into customer-facing pages. On an ecommerce site, that means card skimming or dropping malware on your visitors

Yibelo demonstrated the chain with one specific vulnerable theme, but the underlying Core flaw works against any theme in the catalog that fits the second stage. The fix in 7.1.1, escaping the slug and restricting the selector to actual theme cards, closes the whole family rather than one theme.

What to do about it

If you run WordPress anywhere in your estate, this is a patch-now item, not a patch-next-window item. The PoC is public, the mechanism is documented, and every ransomware crew that watches for CMS chains now has the recipe.

1. Update to WordPress 7.1.1 or later on every install, including staging boxes and forgotten marketing sites
2. Set DISALLOW_FILE_MODS to true in wp-config.php where you can. Patchstack notes this blocks forced theme or plugin installs outright, which kills stage one of the chain even on an unpatched version. It is not a substitute for updating, but it is a real stopgap for sites that need change control before they can patch
3. Audit your admin accounts. Anyone who doesn’t install themes or plugins should not hold the Administrator role
4. Treat admin-side XSS as remote code execution now. This chain turns a “low-severity” stored XSS into full server compromise with one click

Why this matters for African businesses

WordPress runs an enormous share of this continent’s commercial web: agency sites, SME storefronts, university portals, plenty of fintech marketing infrastructure. A chain that needs no credentials and one careless admin click turns the region’s most common CMS into a mass-targeting opportunity. Hosts will patch their servers; the leaked wp-config.php credentials belong to the business, not the host. If anything was exposed, rotate database passwords and auth salts and check your admin user list this week.

eHawu’s network-layer controls exist for this class of problem. When a web server starts running code it never agreed to, the damage shows up as traffic that should not exist, beaconing to attacker infrastructure or data leaving a box that has no business talking to the outside world. Patch the software, and put eyes on the network underneath it.