Skip to navigation

Threat reportVulnerabilityTL-2026-2587

Click2Shell WordPress Exploit Chain Lets Attackers Gain RCE With a Single Malicious Link

criticalACTIVE

Researchers Paulos Yibelo and pwn.ai disclosed 'Click2Shell', a five-stage, pre-authentication exploit chain that turns one crafted link into remote code execution on WordPress.

Key facts for Click2Shell WordPress pre-auth RCE chain

IdentifiersTL-2026-2587
Also known asClick2Shell
SeverityCRITICAL
CVSS9.6
First disclosed
Exploitation statusPublic proof-of-concept exploit
Affected productsWordPress WordPress Core; Mobile Repair Zone (theme developer) Mobile Repair Zone WordPress theme
Weaknesses (CWE)CWE-352, CWE-862, CWE-116
Toolsclick2shell_ajax_installer_poc.py, click2shell_forced_install_poc.py, click2shell_poc.py
MITRE ATT&CK techniquesT1033 System Owner/User Discovery, T1036.005 Match Legitimate Resource Name or Location, T1059.004 Unix Shell, T1071.001 Web Protocols, T1190 Exploit Public-Facing Application, T1203 Exploitation for Client Execution, T1204.001 Malicious Link, T1505.003 Web Shell, T1608.001 Upload Malware
MotivationUNKNOWN
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage for Click2Shell WordPress pre-auth RCE chain

As of 2026-09-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2587 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Click2Shell Stage 1/2 — jQuery Selector Injection on theme-install.php

Detects the Click2Shell forced-theme-install primitive: a crafted `theme` query parameter on WordPress Core's theme-install/preview route containing CSS attribute-terminator and child-combinator metacharacters (e.g. the %22%5D%3E...%2A%3E%2A%3E%2A%2F%2A pattern seen in public PoCs) that breaks out of the unescaped jQuery selector and forces an authenticated administrator's browser to auto-install an attacker-chosen WordPress.org theme without genuine user intent (CVSS 7.1, fixed in WordPress 7.1.1 via escapeSelector()).

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1190, T1204.001, T1203
  • Data sources: apache_access_log, nginx_access_log, azure_application_gateway_waf_log
  • Severity: high
  • Confidence: high

Splunk SPL

index=web sourcetype=access_combined uri_path="*/wp-admin/theme-install.php"
| eval decoded_query=urldecode(uri_query)
| regex decoded_query="(?i)theme=[^&]*[\"'\]][\s]*[>].*[*][>]"
| eval selector_break=if(match(decoded_query, "(?i)(%22%5D%3E|\"\]>|%2A%3E%2A%3E%2A)"), 1, 0)
| where selector_break=1
| table _time src_ip user http_user_agent uri_path decoded_query status
| sort -_time

Microsoft KQL

AzureDiagnostics
| where TimeGenerated > ago(24h)
| where Category in ("ApplicationGatewayAccessLog", "ApplicationGatewayFirewallLog")
| where requestUri_s has "wp-admin/theme-install.php"
| where requestUri_s has_any ("%22%5D%3E", "\"]>", "%2A%3E%2A%3E%2A", "escapeSelector")
| project TimeGenerated, clientIP_s, requestUri_s, httpMethod_s, httpStatus_d, userAgent_s
| order by TimeGenerated desc

Sigma

title: WordPress theme-install.php jQuery Selector Injection (Click2Shell Stage 1/2)
id: 7f3a1e2c-9b4d-4a6f-8e21-3c5d7a9b1f04
status: experimental
description: Detects a crafted theme parameter on WordPress Core's theme-install/preview route containing CSS selector break-out metacharacters that force an admin browser to auto-install an attacker-chosen theme (Click2Shell Stage 1/2).
references:
  - https://pwn.ai/blog/click2shell
  - https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-19
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1204.001
  - attack.t1203
detection:
  selection_path:
    cs-uri-stem|contains: 'wp-admin/theme-install.php'
  selection_payload:
    cs-uri-query|contains:
      - '%22%5D%3E'
      - '"]>'
      - '%2A%3E%2A%3E%2A'
  condition: selection_path and selection_payload
falsepositives:
  - Automated web application security scanners fuzzing the theme parameter as part of authorized testing
level: high
logsource:
  category: webserver

Known false positives:

  • Authorized penetration testers or vulnerability scanners (e.g. Nuclei/Burp) fuzzing the theme-install.php slug parameter with CSS/HTML metacharacters as part of a sanctioned engagement

Tuning notes: If the site fronts theme-install.php behind a CDN/WAF that already URL-decodes query strings before logging, adjust the regex/has_any list to match the decoded form only; exclude known internal QA scanner source IPs via a lookup to cut noise.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Click2Shell Forced Theme-Install Traffic Pattern (theme-install.php + admin-ajax.php Customizer Load) · unlock with TL Creds
  • Web Server Process Spawning Discovery/Shell Commands Post-Plugin-Install (system("id") PoC Pattern) · unlock with TL Creds
  • Repeated Outbound Web-Protocol Callbacks from a WordPress Host to a Single External IP Post-Exploitation · unlock with TL Creds
  • WordPress theme-install.php CSS Selector Break-Out Payload (Click2Shell) · unlock with TL Creds
  • PHP Process Extracting/Loading Newly-Downloaded Plugin ZIP Outside wp-content/upgrade · unlock with TL Creds
  • WordPress admin-ajax.php Plugin-Install Response Followed by Outbound Beacon (Full-Chain Correlation) · unlock with TL Creds
  • Click2Shell Stage 4/5 — Unprotected Mobile Repair Zone AJAX Plugin Installer Abuse · unlock with TL Creds
  • Outbound Ingress Tool Transfer — WordPress Host Fetching Attacker-Hosted Plugin ZIP · unlock with TL Creds

Indicators of compromise for Click2Shell WordPress pre-auth RCE chain

As of 2026-09-19, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-2587.

13 indicators of compromise · unlock with TL Creds. Compare plans

How Click2Shell WordPress pre-auth RCE chain works

A WordPress Core jQuery selector-injection flaw in the theme-preview/install route (CVSS 7.1, patched in 7.1.1) forces a logged-in administrator's browser to silently install an official WordPress.org theme; when the forced-installed theme is the Mobile Repair Zone theme (<= 2.5.4), its unprotected Customizer-preview AJAX handler lets the attacker fetch and execute an arbitrary attacker-hosted plugin ZIP, yielding server-side PHP execution. No CVE had been assigned to either primitive at disclosure and no in-the-wild exploitation was reported.

Click2Shell is a five-stage, single-click exploit chain against WordPress publicly disclosed by researcher Paulos Yibelo and the pwn.ai research team on September 18, 2026, one day after WordPress 7.1.1 shipped the Core fix (initial report: August 22, 2026; full chain demonstrated to WordPress: September 1, 2026; WordPress paid its maximum bug bounty of $300 for the report on September 2, 2026).

Stage 1 (CSS/selector injection): WordPress Core's theme-install/preview JavaScript builds a jQuery selector directly from a URL-supplied theme slug — `$('div[data-slug="' + slug + '"]').trigger('click')`. The WordPress.org Themes API canonicalizes the slug server-side (e.g. to `twentytwenty`) before returning theme metadata, but the administrator's browser retains the original, attacker-supplied string when constructing the selector. A payload such as `twentytwenty"]>*>*>*/*` (delivered as `/wp-admin/theme-install.php?theme=twentytwenty%22%5D%3E%2A%3E%2A%3E%2A%2F%2A`) closes the attribute-value string early, uses CSS child combinators to traverse the theme-card DOM, and neutralizes the trailing syntax with a comment token.

Stage 2 (forced auto-install): WordPress's own script then executes `.trigger('click')` against the matched element, programmatically clicking the real Install control for an attacker-chosen theme already published in the official WordPress.org catalog — no genuine user action is required beyond the initial link click. The installed theme is never activated, so the site's front end and the administrator's Themes screen show nothing unusual.

Stage 3 (pre-activation loading): Visiting `/wp-admin/admin-ajax.php?wp_customize=on&customize_theme=THEME_SLUG` loads the forced-installed, still-inactive theme's PHP into a Customizer preview — WordPress executes a theme's PHP before the theme is ever activated.

Stage 4 (unprotected AJAX handler): When the forced-installed theme is Mobile Repair Zone (version 2.5.4 or earlier), its Customizer-preview code registers the authenticated AJAX action `wp_ajax_mobile_repair_zone_install_and_activate_plugin`, handled by `mobile_repair_zone_install_and_activate_plugin()`. The handler reads attacker-controlled `plugin_details[plugin_text_domain]`, `plugin_details[plugin_main_file]`, and `plugin_details[plugin_url]` POST parameters with no nonce verification and no `install_plugins` capability check.

Stage 5 (code execution): The handler downloads and unpacks a ZIP package from the attacker-supplied `plugin_url`, then loads the extracted plugin's PHP entry point, executing attacker-controlled PHP under the web server account. Published PoC payloads demonstrated this with the harmless command `system("id")`; the researchers noted that full code execution requires this second, vulnerable-theme primitive — "the Core bug does not accept an arbitrary theme ZIP by itself."

Researchers rated the Stage 1/2 forced-install primitive alone as CVSS 3.1 7.1 (High) and the complete five-stage chain to code execution as Critical (9.3 per pwn.ai's own writeup; reported as 9.6 by some secondary press coverage). WordPress fixed the Core primitive in 7.1.1 (September 17, 2026, changeset 63664): the selector is now constrained to a genuine `div.theme` card and the URL-derived slug is passed through jQuery's `escapeSelector()` before being used to build the selector — `$('div.theme[data-slug="' + $.escapeSelector(slug) + '"]').trigger('click')` — converting injected characters into literal, non-executable slug text. The fix was backported to all supported branches back to 4.7. The 7.1.1 release bundled 11 security fixes in total: the Click2Shell/theme-install-CSRF fix credited to Paulos Yibelo and pwn.ai, plus 10 unrelated issues including an unauthenticated stored XSS in `wpautop()` tracked as CVE-2026-93485 (reported by Rafie Muhammad), a stored XSS in custom header images and an HTML-API comment-breakout bug (both reported by WordPress Security Team member Jeremy Felt), an authenticated path-traversal bug in the WP REST Templates Controller and a contributor-level arbitrary post-overwrite bug (both credited to Anthropic), an XML-RPC `edit_css`-capability bypass, a multisite plugin-activation flaw, and disclosure bugs affecting draft-post slugs and private parent-post titles — alongside 17 Core and 19 Block Editor bug fixes unrelated to security. WordPress credited Paulos Yibelo and pwn.ai and paid its maximum bug-bounty award ($300) for the report; no CVE identifier had been published for either Click2Shell primitive as of disclosure, though pwn.ai stated WordPress indicated one would follow.

Public Python proof-of-concept implementations of the full chain (`click2shell_poc.py`) and of each standalone primitive (`click2shell_forced_install_poc.py`, `click2shell_ajax_installer_poc.py`) were published on GitHub (HackfutSecRoot/click2shell, Usman0220/click2shell-poc) shortly after disclosure, explicitly scoped by their authors to authorized lab testing against owned/authorized WordPress installations. No evidence of in-the-wild exploitation was reported by any source at time of writing. The disclosure follows the same pwn.ai research line as two prior, distinct WordPress Core issues: XSS2Shell, a pre-auth login-screen XSS-to-RCE chain also credited to Yibelo and pwn.ai and tracked as CVE-2026-64638 (disclosed August 7, 2026; CVSS 8.9; fixed in WordPress 7.0.3; affected 6.4 through 7.0.2 via DOM clobbering, an auto-executing core script, a REST API JSONP callback, and a Same Origin Method Execution trick to steal an administrator's Application Password), and the unrelated 'wp2shell' flaw from July 2026, which CISA lists as actively exploited in the wild — Click2Shell itself carries no such KEV listing.

MITRE ATT&CK techniques by tactic:

Discovery

T1033 System Owner/User Discovery

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location

Execution

T1059.004 Unix Shell; T1203 Exploitation for Client Execution; T1204.001 Malicious Link

Command and Control

T1071.001 Web Protocols

Initial Access

T1190 Exploit Public-Facing Application

Persistence

T1505.003 Web Shell

Resource Development

T1608.001 Upload Malware

Remediation for Click2Shell WordPress pre-auth RCE chain

Patches

  • WordPress 7.1.1 (released 2026-09-17, changeset 63664) — constrains the theme-install selector to div.theme and applies jQuery escapeSelector() to the URL-derived theme slug

Immediate actions

  • Update WordPress Core to 7.1.1 or later (or the matching backported security release for branches 4.7 through 7.1)
  • Audit installed themes for the Mobile Repair Zone theme (version 2.5.4 or earlier) and remove or deactivate it until a vendor fix is confirmed
  • Audit sites for unexpectedly-installed, inactive themes pulled from the WordPress.org catalog that the site owner did not knowingly install
  • Review web server and admin-ajax.php access logs for calls to wp_ajax_mobile_repair_zone_install_and_activate_plugin, POST bodies containing a plugin_details[plugin_url] parameter, or other unrecognized AJAX actions invoked during Customizer preview of an inactive theme

Workarounds

  • Restrict wp-admin access via IP allowlisting or VPN to reduce the chance of a crafted link reaching an authenticated administrator's browser
  • Deactivate or remove the Mobile Repair Zone theme (<= 2.5.4) pending a vendor-side fix

Longer-term hardening

  • Enforce nonce verification and current_user_can()/install_plugins capability checks on every custom AJAX handler shipped in themes/plugins distributed via the WordPress.org repository
  • Add WAF/logging rules to flag theme-install.php requests whose theme parameter contains CSS/selector metacharacters (quotes, combinators, comment sequences) such as the %22%5D%3E pattern
  • Restrict administrator exposure to unsolicited external links, since the chain requires only a single click by an already-authenticated admin
  • Track public PoC repositories (e.g. click2shell_poc.py request patterns and its --theme/--package/--cookie arguments) for signature development against WordPress admin endpoints

Affected and fixed versions

  • WordPress — WordPress Core
    Vulnerable versions: 6.0 through versions immediately before 7.1.1
    Fixed in: 7.1.1; matching backported security releases for supported branches 4.7 through 7.1
  • Mobile Repair Zone (theme developer) — Mobile Repair Zone WordPress theme
    Vulnerable versions: <= 2.5.4
    Fixed in: not confirmed at time of disclosure

Timeline of Click2Shell WordPress pre-auth RCE chain

  • locked-ioc-13 and locked-ioc-10 disclose a distinct, prior WordPress Core chain, XSS2Shell (CVE-2026-64638, CVSS 8.9), a pre-auth login-screen XSS chained via DOM clobbering to Application Password theft and PHP code execution; fixed in WordPress 7.0.3.
  • locked-ioc-10 and locked-ioc-13 report the WordPress Core theme-preview selector-injection and unintended forced-install behavior to WordPress.
  • Researchers demonstrate and disclose the complete five-stage pre-activation-to-RCE chain, pairing the Core primitive with the Mobile Repair Zone theme's unprotected AJAX plugin installer, to the locked-ioc-6.
  • WordPress's bug bounty program pays its maximum allocation ($300) to locked-ioc-10 and locked-ioc-13 for the report.
  • WordPress 7.1.1 ships (changeset 63664), constraining the theme-install jQuery selector to div.theme and applying jQuery escapeSelector() to the URL-derived theme slug, closing the forced-install primitive; the release bundles 11 security fixes total and backports the Click2Shell fix to supported branches back to 4.7, alongside 17 Core and 19 Block Editor bug fixes.
  • locked-ioc-13 publishes 'Preauth WordPress Core Theme Preview Injection to RCE', the full technical writeup naming and detailing the Click2Shell chain, rating the complete chain 9.3 Critical.
  • Threadlinqs Intelligence begins tracking the disclosure as TL-2026-2587 based on the Cyber Security News report.
  • Public proof-of-concept implementations of the full three-script chain (HackfutSecRoot/click2shell, Usman0220/click2shell-poc), each exposing --target/--theme/--lhost/--lport/--cookie/--package arguments, appear on GitHub, restricted by their authors to authorized lab testing.
  • Cyber Security News, The Hacker News, and GBHackers publish independent coverage of the Click2Shell disclosure and the WordPress 7.1.1 security release, with some outlets citing a 9.6 Critical score for the full chain.

Sources cited for Click2Shell WordPress pre-auth RCE chain

Previous and next in vulnerability

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats