Click2Shell: WordPress Theme-Preview CSRF/Selector-Injection Chain to Forced Theme Install

Click2Shell: WordPress Theme-Preview CSRF/Selector-Injection (TL-2026-2597), also tracked as Click2Shell, is a critical-severity software vulnerability scored CVSS 9.3, first published 2026-09-21. It has no confirmed attribution, affects WordPress WordPress Core, maps to 10 MITRE ATT&CK techniques (T1059.007, T1190, T1203), and is covered by 9 detection rules and 12 indicators of compromise.

Key facts for TL-2026-2597

Threat ID
TL-2026-2597
Also known as
Click2Shell
Severity
CRITICAL
CVSS
9.3
Status
PATCHED
Category
VULNERABILITY
First published
2026-09-21
Last reviewed
2026-09-21
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, mediapublishing, ecommerce, smallbusiness, education
Target regions
Global
Detection rules
9
Indicators of compromise
12

Malware and tooling in Click2Shell: WordPress Theme-Preview CSRF/Selector-Injection

Malware and tooling: click2shell (HackfutSecRoot/click2shell), click2shell-poc (Usman0220/click2shell-poc)

PWN AI researcher Paulos Yibelo disclosed Click2Shell, a WordPress core flaw where a crafted theme-install URL clicked by a logged-in administrator abuses a jQuery-selector/theme-slug parsing mismatch to silently force-install an inactive WordPress.org theme, then chains that with a nonce/capability-free AJAX plugin-installer in the Mobile Repair Zone theme (v2.5.4) to reach remote PHP code execution. WordPress 7.1.1 (September 17, 2026) patched the core selector-injection flaw; no CVE had been assigned at publication (September 18, 2026) and no in-the-wild exploitation has been reported.

How Click2Shell: WordPress Theme-Preview CSRF/Selector-Injection works

Click2Shell chains two separate weaknesses into a one-click, pre-authenticated-victim path to remote code execution on WordPress sites. The root cause is a parsing mismatch: when a theme slug is supplied via the `theme` query parameter to `/wp-admin/theme-install.php`, the server-side WordPress.org Themes API canonicalizes the value into a legitimate theme slug, but the admin-side JavaScript in `/wp-admin/js/theme.js` builds a DOM/jQuery selector directly from the raw, un-sanitized URL value: `$( 'div[data-slug="' + slug + '"]' ).trigger( 'click' )`. By injecting CSS-selector metacharacters into the parameter (the published PoC uses `twentytwenty%22%5D%3E%2A%3E%2A%3E%2A%2F%2A`, which decodes to `twentytwenty"]>*>*>*/*`), an attacker escapes the intended attribute selector and redirects the programmatic click onto the theme card's Install control. Because the server independently resolves the parameter to a real, legitimate WordPress.org theme, the request appears benign to WordPress core even though the browser was tricked into clicking Install on an attacker-chosen theme.

When an authenticated administrator opens the crafted link (directly, via an embedded iframe, or as a chained XSS sink), this selector-injection primitive causes their own browser, running with their own session, to silently install (but not activate) an attacker-chosen theme from the public WordPress.org directory -- no confirmation dialog is shown, and because the site's visibly active theme never changes, administrators have no visual indicator that anything happened. A second crafted link then loads the WordPress Customizer preview for that inactive theme (`/wp-admin/admin-ajax.php?wp_customize=on&customize_theme=<slug>`), which is sufficient to execute the theme's `functions.php` even though the theme was never formally activated -- a pre-activation execution path distinct from, and generally overlooked relative to, ordinary theme-activation review. PWN AI's proof-of-concept paired this pre-activation execution with a real-world theme defect: Mobile Repair Zone v2.5.4 registers an AJAX action, `wp_ajax_mobile_repair_zone_install_and_activate_plugin`, whose handler `mobile_repair_zone_install_and_activate_plugin()` performs no `check_ajax_referer()` nonce verification and no `current_user_can()` capability check. The handler accepts attacker-supplied `plugin_details[plugin_url]`, `plugin_details[plugin_text_domain]`, and `plugin_details[plugin_main_file]` POST parameters and will fetch a base64-encoded plugin ZIP from an arbitrary, attacker-controlled external URL (no domain allowlist or origin check), extract it, and load its PHP entry point, giving the attacker arbitrary PHP execution under the web server's privileges.

PWN AI further documented that this missing-nonce/missing-capability pattern on a `wp_ajax_*` installer handler is not unique to Mobile Repair Zone: the researchers identified more than 40 additional third-party WordPress themes registering similarly unprotected plugin/theme-installer AJAX actions, meaning the RCE half of the chain generalizes well beyond the single theme used in the published PoC and the real-world blast radius depends on which of these themes a given site has installed (active or not). PWN AI rated the isolated forced-install primitive High (CVSS 3.1, 7.1) and the complete demonstrated chain to pre-activation code execution Critical (CVSS 3.1, 9.3, with a UI:R -- user interaction required -- component lowering the score from a theoretical maximum); Patchstack's independent write-up corroborates the 9.3 figure, while The Hacker News' coverage instead reports 9.6 for the full chain -- both accounts agree on 7.1 for the isolated core flaw. Because the WordPress core bug alone does not accept an arbitrary theme ZIP, full remote code execution depends on chaining it with a second, independently-vulnerable theme or plugin such as Mobile Repair Zone; the core flaw's real-world severity is therefore a function of what vulnerable themes/plugins are installed on a given site. Exploitation requires an administrator to click a link (via phishing or a chained XSS) and requires the target site to permit file modifications (sites with `DISALLOW_FILE_MODS` enabled are not exploitable for the RCE portion). WordPress fixed the core issue in 7.1.1 (released September 17, 2026, alongside ten other, unrelated security fixes credited to separate researchers) by scoping the vulnerable selector strictly to real `.theme` DOM elements and passing the slug through jQuery's `$.escapeSelector()` before insertion (`$( 'div.theme[data-slug="' + $.escapeSelector( slug ) + '"]' ).trigger( 'click' )`), treating attacker input as literal text rather than structural selector syntax. No CVE identifier had been assigned as of the September 18, 2026 public disclosure, though WordPress indicated one would follow; there is no evidence of in-the-wild exploitation, and Patchstack noted its customers received automatic virtual-patch protection ahead of the vendor fix.

MITRE ATT&CK techniques used in TL-2026-2597

Execution

T1059.007 JavaScript; T1203 Exploitation for Client Execution; T1204.001 Malicious Link

Initial Access

T1190 Exploit Public-Facing Application; T1566.002 Spearphishing Link

Persistence

T1505.003 Web Shell

Defense Evasion

T1564 Hide Artifacts

Resource Development

T1583.006 Web Services; T1587.004 Exploits; T1588.006 Vulnerabilities

Affected products and versions in Click2Shell: WordPress Theme-Preview CSRF/Selector-Injection

  • WordPress — WordPress Core
    Vulnerable versions: < 7.1.1 (security backports issued back through the 4.7 branch)
    Fixed in: 7.1.1
  • themagnifico52 — Mobile Repair Zone (WordPress theme)
    Vulnerable versions: 2.5.4
    Fixed in: Unconfirmed -- the theme was updated to 2.5.5 on WordPress.org on 2026-09-09, but the public changelog does not attribute this update to the AJAX nonce/capability fix

Remediation for Click2Shell: WordPress Theme-Preview CSRF/Selector-Injection

Patches

  • WordPress 7.1.1 (September 17, 2026) -- scopes the vulnerable jQuery selector to legitimate .theme DOM elements and escapes the URL-derived theme slug with $.escapeSelector() before it is used in selector construction

Immediate actions

  • Update WordPress core to 7.1.1 or later immediately -- the release fixes the theme-preview selector-injection flaw plus ten other, unrelated security issues
  • Audit installed themes for the Mobile Repair Zone theme (WordPress.org slug mobile-repair-zone); versions <=2.5.4 shipped an AJAX plugin-installer with no nonce or capability checks -- update to the current release or remove the theme if unused
  • Audit ALL installed themes (active and inactive) for wp_ajax_* handlers that install or activate plugins without check_ajax_referer()/current_user_can() -- PWN AI identified 40+ third-party themes beyond Mobile Repair Zone sharing this pattern
  • Enable the DISALLOW_FILE_MODS constant (or equivalent host-level file-modification restriction) as a compensating control against forced theme/plugin installation
  • Instruct administrators not to click unsolicited or unfamiliar wp-admin links while authenticated to WordPress

Workarounds

  • Disable theme/plugin installation via DISALLOW_FILE_MODS where administrators do not need to install themes directly from wp-admin
  • Remove or update any installed theme/plugin whose AJAX handlers install remote packages without visible nonce/capability checks
  • Patchstack virtual-patching customers received automatic protection ahead of the vendor fix, per Patchstack's disclosure write-up

Longer-term hardening

  • Require nonce verification (check_ajax_referer) and capability checks (current_user_can) as a mandatory review gate on every wp_ajax_* handler shipped in themes/plugins before release
  • Deploy a WAF rule flagging theme-install and customize_theme requests whose theme parameter contains CSS-selector metacharacters (e.g. ", ], >, *)
  • Restrict the WordPress Administrator role to the minimum necessary accounts and monitor for unexpected theme or plugin installation events, including installs that never result in an active-theme change
  • Enforce re-authentication or step-up confirmation for sensitive one-click admin actions such as theme installation

Weaknesses (CWE) in Click2Shell: WordPress Theme-Preview CSRF/Selector-Injection

CWE-352, CWE-862, CWE-1021, CWE-94

Timeline of Click2Shell: WordPress Theme-Preview CSRF/Selector-Injection

  • PWN AI researcher Paulos Yibelo reports the theme-preview selector-injection / silent forced-install flaw to the WordPress Security Team.
  • PWN AI demonstrates the complete pre-activation chain, pairing the core forced-install primitive with the Mobile Repair Zone theme's unprotected AJAX plugin-installer to reach code execution, and separately catalogs 40+ other third-party themes with the same missing nonce/capability pattern.
  • The Mobile Repair Zone theme is updated to version 2.5.5 on the WordPress.org repository; the public changelog does not confirm this update addresses the AJAX nonce/capability gap used in the PoC.
  • WordPress 7.1.1 is released, escaping the URL-derived theme slug with $.escapeSelector() and scoping the vulnerable selector to legitimate .theme elements, alongside ten other unrelated security fixes.
  • GBHackers separately publishes a roundup of all 11 security fixes in WordPress 7.1.1, naming the Click2Shell theme-install issue alongside ten unrelated stored-XSS, path-traversal, access-control, and information-disclosure fixes credited to other researchers.
  • PWN AI and Paulos Yibelo publish the full Click2Shell technical disclosure at pwn.ai/blog/click2shell; The Hacker News, Patchstack, and BornCity publish coverage the same day, with The Hacker News reporting a 9.6 full-chain CVSS figure versus pwn.ai/Patchstack's 9.3.
  • GBHackers publishes dedicated coverage of Click2Shell, the source article that triggered this threat record.

Sources cited for Click2Shell: WordPress Theme-Preview CSRF/Selector-Injection

More in vulnerability

Detection coverage for TL-2026-2597

As of 2026-09-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2597 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats