# Click2Shell WordPress Exploit Chain Lets Attackers Gain RCE With a Single Malicious Link

> Researchers Paulos Yibelo and pwn.ai disclosed 'Click2Shell', a five-stage, pre-authentication exploit chain that turns one crafted link into remote code execution on WordPress. A WordPress Core jQuery selector-injection flaw in the theme-preview/install route (CVSS 7.1, patched in 7.1.1) forces a logged-in administrator's browser to silently install an official WordPress.org theme; when the forced-installed theme is the Mobile Repair Zone theme (<= 2.5.4), its unprotected Customizer-preview AJAX handler lets the attacker fetch and execute an arbitrary attacker-hosted plugin ZIP, yielding server-side PHP execution. No CVE had been assigned to either primitive at disclosure and no in-the-wild exploitation was reported.

- **Published:** 2026-09-19T00:00:00Z
- **Last reviewed:** 2026-09-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2587
- **ID:** TL-2026-2587
- **Severity:** CRITICAL (CVSS 9.6)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Click2Shell is a five-stage, single-click exploit chain against WordPress publicly disclosed by researcher Paulos Yibelo and the pwn.ai research team on September 18, 2026, one day after WordPress 7.1.1 shipped the Core fix (initial report: August 22, 2026; full chain demonstrated to WordPress: September 1, 2026; WordPress paid its maximum bug bounty of $300 for the report on September 2, 2026).

Stage 1 (CSS/selector injection): WordPress Core's theme-install/preview JavaScript builds a jQuery selector directly from a URL-supplied theme slug — `$('div[data-slug="' + slug + '"]').trigger('click')`. The WordPress.org Themes API canonicalizes the slug server-side (e.g. to `twentytwenty`) before returning theme metadata, but the administrator's browser retains the original, attacker-supplied string when constructing the selector. A payload such as `twentytwenty"]>*>*>*/*` (delivered as `/wp-admin/theme-install.php?theme=twentytwenty%22%5D%3E%2A%3E%2A%3E%2A%2F%2A`) closes the attribute-value string early, uses CSS child combinators to traverse the theme-card DOM, and neutralizes the trailing syntax with a comment token.

Stage 2 (forced auto-install): WordPress's own script then executes `.trigger('click')` against the matched element, programmatically clicking the real Install control for an attacker-chosen theme already published in the official WordPress.org catalog — no genuine user action is required beyond the initial link click. The installed theme is never activated, so the site's front end and the administrator's Themes screen show nothing unusual.

Stage 3 (pre-activation loading): Visiting `/wp-admin/admin-ajax.php?wp_customize=on&customize_theme=THEME_SLUG` loads the forced-installed, still-inactive theme's PHP into a Customizer preview — WordPress executes a theme's PHP before the theme is ever activated.

Stage 4 (unprotected AJAX handler): When the forced-installed theme is Mobile Repair Zone (version 2.5.4 or earlier), its Customizer-preview code registers the authenticated AJAX action `wp_ajax_mobile_repair_zone_install_and_activate_plugin`, handled by `mobile_repair_zone_install_and_activate_plugin()`. The handler reads attacker-controlled `plugin_details[plugin_text_domain]`, `plugin_details[plugin_main_file]`, and `plugin_details[plugin_url]` POST parameters with no nonce verification and no `install_plugins` capability check.

Stage 5 (code execution): The handler downloads and unpacks a ZIP package from the attacker-supplied `plugin_url`, then loads the extracted plugin's PHP entry point, executing attacker-controlled PHP under the web server account. Published PoC payloads demonstrated this with the harmless command `system("id")`; the researchers noted that full code execution requires this second, vulnerable-theme primitive — "the Core bug does not accept an arbitrary theme ZIP by itself."

Researchers rated the Stage 1/2 forced-install primitive alone as CVSS 3.1 7.1 (High) and the complete five-stage chain to code execution as Critical (9.3 per pwn.ai's own writeup; reported as 9.6 by some secondary press coverage). WordPress fixed the Core primitive in 7.1.1 (September 17, 2026, changeset 63664): the selector is now constrained to a genuine `div.theme` card and the URL-derived slug is passed through jQuery's `escapeSelector()` before being used to build the selector — `$('div.theme[data-slug="' + $.escapeSelector(slug) + '"]').trigger('click')` — converting injected characters into literal, non-executable slug text. The fix was backported to all supported branches back to 4.7. The 7.1.1 release bundled 11 security fixes in total: the Click2Shell/theme-install-CSRF fix credited to Paulos Yibelo and pwn.ai, plus 10 unrelated issues including an unauthenticated stored XSS in `wpautop()` tracked as CVE-2026-93485 (reported by Rafie Muhammad), a stored XSS in custom header images and an HTML-API comment-breakout bug (both reported by WordPress Security Team member Jeremy Felt), an authenticated path-traversal bug in the WP REST Templates Controller and a contributor-level arbitrary post-overwrite bug (both credited to Anthropic), an XML-RPC `edit_css`-capability bypass, a multisite plugin-activation flaw, and disclosure bugs affecting draft-post slugs and private parent-post titles — alongside 17 Core and 19 Block Editor bug fixes unrelated to security. WordPress credited Paulos Yibelo and pwn.ai and paid its maximum bug-bounty award ($300) for the report; no CVE identifier had been published for either Click2Shell primitive as of disclosure, though pwn.ai stated WordPress indicated one would follow.

Public Python proof-of-concept implementations of the full chain (`click2shell_poc.py`) and of each standalone primitive (`click2shell_forced_install_poc.py`, `click2shell_ajax_installer_poc.py`) were published on GitHub (HackfutSecRoot/click2shell, Usman0220/click2shell-poc) shortly after disclosure, explicitly scoped by their authors to authorized lab testing against owned/authorized WordPress installations. No evidence of in-the-wild exploitation was reported by any source at time of writing. The disclosure follows the same pwn.ai research line as two prior, distinct WordPress Core issues: XSS2Shell, a pre-auth login-screen XSS-to-RCE chain also credited to Yibelo and pwn.ai and tracked as CVE-2026-64638 (disclosed August 7, 2026; CVSS 8.9; fixed in WordPress 7.0.3; affected 6.4 through 7.0.2 via DOM clobbering, an auto-executing core script, a REST API JSONP callback, and a Same Origin Method Execution trick to steal an administrator's Application Password), and the unrelated 'wp2shell' flaw from July 2026, which CISA lists as actively exploited in the wild — Click2Shell itself carries no such KEV listing.

## MITRE ATT&CK

- T1608.001 Upload Malware
- T1190 Exploit Public-Facing Application
- T1204.001 Malicious Link
- T1203 Exploitation for Client Execution
- T1059.004 Unix Shell
- T1505.003 Web Shell
- T1036.005 Match Legitimate Resource Name or Location
- T1033 System Owner/User Discovery
- T1071.001 Web Protocols

## Sources

- [Click2Shell WordPress Flaw Lets Attackers Gain RCE With a Single Malicious Link](https://cybersecuritynews.com/click2shell-wordpress-vulnerability/)
- [Preauth WordPress Core Theme Preview Injection to RCE — Click2Shell](https://pwn.ai/blog/click2shell)
- [New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution](https://thehackernews.com/2026/09/new-wordpress-click2shell-flaw-forces.html)
- [WordPress 7.1.1 Maintenance and Security Release](https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/)
- [WordPress 7.1.1 Fixes 11 Security Flaws Including Stored XSS and Path Traversal](https://gbhackers.com/wordpress-7-1-1-fixes-11-security-flaws/)
- [WordPress 7.1.1 Maintenance and Security Release](https://patchstack.com/articles/wordpress-7-1-1-maintenance-and-security-release/)
- [click2shell — WordPress Pre-Auth RCE Chain (PoC)](https://github.com/HackfutSecRoot/click2shell)
- [click2shell-poc — PoC scripts for the Click2Shell WordPress pre-auth RCE chain](https://github.com/Usman0220/click2shell-poc)
- [WordPress XSS2Shell: Unauthenticated Login-Screen XSS to PHP Code Execution (CVE-2026-64638)](https://pwn.ai/blog/xss2shell)
- [New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP](https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2587