Click2Shell: WordPress Theme-Preview CSRF/Selector-Injection Chain to Forced Theme Install

Key facts for Click2Shell WordPress RCE

Detection coverage for Click2Shell WordPress RCE

As of 2026-09-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2597 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: WordPress theme-install.php CSS/jQuery Selector-Injection URL (Click2Shell Forced-Install Primitive)

Detects an HTTP request to /wp-admin/theme-install.php whose theme query parameter contains CSS-selector metacharacters (", ], >, *) either raw or URL-encoded. This is the core Click2Shell exploitation primitive: WordPress core's Themes API canonicalizes the slug server-side while pre-7.1.1 admin JS (/wp-admin/js/theme.js) builds a jQuery selector from the raw un-sanitized value, letting an attacker escape the attribute selector (e.g. twentytwenty%22%5D%3E%2A%3E%2A%3E%2A%2F%2A) and redirect a logged-in administrator's own click onto the Install control for an attacker-chosen theme. Requires the request to be observed against an authenticated wp-admin session (referer/cookie present) to distinguish from scanner noise.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1566.002, T1204.001
• Data sources: wordpress_access_logs, apache_nginx_access_logs, azure_app_service_http_logs, waf_logs
• Severity: critical
• Confidence: high

Splunk SPL

index=web (sourcetype=wordpress:access OR sourcetype=access_combined OR sourcetype=access_common)
  uri_path="*/wp-admin/theme-install.php"
| rex field=uri_query "theme=(?<theme_param>[^&]+)"
| eval theme_param_decoded=urldecode(theme_param)
| where match(theme_param, "(?i)(%22|%5d|%3e|%2a)") OR match(theme_param_decoded, "[\"\]>*]")
| where isnotnull(cookie) OR match(http_user_agent, "(?i)mozilla") 
| eval has_admin_cookie=if(match(cookie, "(?i)wordpress_logged_in"), "true", "false")
| stats count min(_time) as first_seen max(_time) as last_seen values(theme_param) as theme_params values(http_user_agent) as user_agents values(has_admin_cookie) as admin_session_present by clientip, uri_path, http_referer
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

AppServiceHTTPLogs
| where TimeGenerated > ago(24h)
| where CsUriStem has "/wp-admin/theme-install.php"
| extend ThemeParam = extract(@"theme=([^&]+)", 1, tostring(CsUriQuery))
| where ThemeParam matches regex @"(?i)(%22|%5d|%3e|%2a)" or ThemeParam matches regex @'[\"\]>*]'
| extend CookiePresent = iif(isnotempty(CsCookie) and CsCookie has "wordpress_logged_in", true, false)
| project TimeGenerated, CIp, CsUriStem, ThemeParam, CookiePresent, CsUserAgent, CsReferer, ScStatus
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Count = count(), ThemeParams = make_set(ThemeParam), AdminSessionSeen = max(CookiePresent) by CIp, CsUriStem
| where Count >= 1

Sigma

title: WordPress Click2Shell Theme-Slug Selector-Injection Request
id: 7a1e4c2d-9f3b-4e6a-8c1d-2b5f9a7e3c10
status: experimental
description: Detects requests to WordPress core's theme-install.php containing CSS-selector metacharacters in the theme parameter, the core Click2Shell forced-install exploitation primitive that redirects an authenticated admin's programmatic click to an attacker-chosen theme.
references:
    - https://pwn.ai/blog/click2shell
    - https://patchstack.com/articles/click2shell-the-rce-wordpress-7-1-1-just-patched/
    - https://thehackernews.com/2026/09/new-wordpress-click2shell-flaw-forces.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-21
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1204.001
    - attack.t1566.002
    - cve.2026.click2shell
logsource:
    category: webserver
    product: apache
detection:
    selection_path:
        cs-uri-stem|contains: '/wp-admin/theme-install.php'
    selection_payload:
        cs-uri-query|contains:
            - 'theme=%22%5d%3e%2a'
            - 'theme=%22]>*'
            - '"]>*'
            - '%22%5D%3E'
    condition: selection_path and selection_payload
falsepositives:
    - Automated vulnerability scanners probing theme-install.php with fuzzed parameters (non-authenticated context)
    - Security researcher validation testing against a lab/staging instance
level: high

Known false positives:

• Automated WordPress vulnerability scanners fuzzing theme-install.php with arbitrary special characters, not chained to an authenticated admin click
• Security research/lab reproduction of the published PoC against a non-production instance

Tuning notes: Correlate with the presence of a wordpress_logged_in_* session cookie on the same request to confirm the victim was an authenticated administrator (this is the distinguishing factor from harmless scanner noise); if WAF/CDN logs available, alert only when the payload decodes to CSS-selector metacharacters rather than alerting on every theme= parameter.

• 🔒 WordPress theme-install.php CSS/jQuery Selector-Injection URL (Click2Shell Forced-Install Primitive) · unlock with TL Creds
• 🔒 WordPress Customizer Pre-Activation Load or Unauthenticated wp_ajax Plugin-Installer Call · unlock with TL Creds
• 🔒 WordPress Server Egress Fetch of Remote Plugin ZIP Followed by New PHP Web Shell Artifact (Click2Shell RCE Delivery) · unlock with TL Creds
• 🔒 WordPress theme-install.php CSS/jQuery Selector-Injection URL (Click2Shell Forced-Install Primitive) · unlock with TL Creds
• 🔒 WordPress Customizer Pre-Activation Load or Unauthenticated wp_ajax Plugin-Installer Call · unlock with TL Creds
• 🔒 WordPress Server Outbound Plugin ZIP Fetch Followed by New PHP Web Shell Artifact (Click2Shell RCE Delivery) · unlock with TL Creds
• 🔒 WordPress Customizer Pre-Activation Load + Unauthenticated AJAX Plugin-Installer Invocation (Mobile Repair Zone Pattern) · unlock with TL Creds
• 🔒 WordPress Server Egress Fetch of Remote Plugin ZIP Followed by New PHP Web Shell Artifact (Click2Shell RCE Delivery) · unlock with TL Creds

Indicators of compromise for Click2Shell WordPress RCE

As of 2026-09-21, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-2597.

How Click2Shell WordPress RCE works

WordPress 7.1.1 (September 17, 2026) patched the core selector-injection flaw; no CVE had been assigned at publication (September 18, 2026) and no in-the-wild exploitation has been reported.

Click2Shell chains two separate weaknesses into a one-click, pre-authenticated-victim path to remote code execution on WordPress sites. The root cause is a parsing mismatch: when a theme slug is supplied via the `theme` query parameter to `/wp-admin/theme-install.php`, the server-side WordPress.org Themes API canonicalizes the value into a legitimate theme slug, but the admin-side JavaScript in `/wp-admin/js/theme.js` builds a DOM/jQuery selector directly from the raw, un-sanitized URL value: `$( 'div[data-slug="' + slug + '"]' ).trigger( 'click' )`. By injecting CSS-selector metacharacters into the parameter (the published PoC uses `twentytwenty%22%5D%3E%2A%3E%2A%3E%2A%2F%2A`, which decodes to `twentytwenty"]>*>*>*/*`), an attacker escapes the intended attribute selector and redirects the programmatic click onto the theme card's Install control. Because the server independently resolves the parameter to a real, legitimate WordPress.org theme, the request appears benign to WordPress core even though the browser was tricked into clicking Install on an attacker-chosen theme.

When an authenticated administrator opens the crafted link (directly, via an embedded iframe, or as a chained XSS sink), this selector-injection primitive causes their own browser, running with their own session, to silently install (but not activate) an attacker-chosen theme from the public WordPress.org directory -- no confirmation dialog is shown, and because the site's visibly active theme never changes, administrators have no visual indicator that anything happened. A second crafted link then loads the WordPress Customizer preview for that inactive theme (`/wp-admin/admin-ajax.php?wp_customize=on&customize_theme=<slug>`), which is sufficient to execute the theme's `functions.php` even though the theme was never formally activated -- a pre-activation execution path distinct from, and generally overlooked relative to, ordinary theme-activation review. PWN AI's proof-of-concept paired this pre-activation execution with a real-world theme defect: Mobile Repair Zone v2.5.4 registers an AJAX action, `wp_ajax_mobile_repair_zone_install_and_activate_plugin`, whose handler `mobile_repair_zone_install_and_activate_plugin()` performs no `check_ajax_referer()` nonce verification and no `current_user_can()` capability check. The handler accepts attacker-supplied `plugin_details[plugin_url]`, `plugin_details[plugin_text_domain]`, and `plugin_details[plugin_main_file]` POST parameters and will fetch a base64-encoded plugin ZIP from an arbitrary, attacker-controlled external URL (no domain allowlist or origin check), extract it, and load its PHP entry point, giving the attacker arbitrary PHP execution under the web server's privileges.

PWN AI further documented that this missing-nonce/missing-capability pattern on a `wp_ajax_*` installer handler is not unique to Mobile Repair Zone: the researchers identified more than 40 additional third-party WordPress themes registering similarly unprotected plugin/theme-installer AJAX actions, meaning the RCE half of the chain generalizes well beyond the single theme used in the published PoC and the real-world blast radius depends on which of these themes a given site has installed (active or not). PWN AI rated the isolated forced-install primitive High (CVSS 3.1, 7.1) and the complete demonstrated chain to pre-activation code execution Critical (CVSS 3.1, 9.3, with a UI:R -- user interaction required -- component lowering the score from a theoretical maximum); Patchstack's independent write-up corroborates the 9.3 figure, while The Hacker News' coverage instead reports 9.6 for the full chain -- both accounts agree on 7.1 for the isolated core flaw. Because the WordPress core bug alone does not accept an arbitrary theme ZIP, full remote code execution depends on chaining it with a second, independently-vulnerable theme or plugin such as Mobile Repair Zone; the core flaw's real-world severity is therefore a function of what vulnerable themes/plugins are installed on a given site. Exploitation requires an administrator to click a link (via phishing or a chained XSS) and requires the target site to permit file modifications (sites with `DISALLOW_FILE_MODS` enabled are not exploitable for the RCE portion). WordPress fixed the core issue in 7.1.1 (released September 17, 2026, alongside ten other, unrelated security fixes credited to separate researchers) by scoping the vulnerable selector strictly to real `.theme` DOM elements and passing the slug through jQuery's `$.escapeSelector()` before insertion (`$( 'div.theme[data-slug="' + $.escapeSelector( slug ) + '"]' ).trigger( 'click' )`), treating attacker input as literal text rather than structural selector syntax. No CVE identifier had been assigned as of the September 18, 2026 public disclosure, though WordPress indicated one would follow; there is no evidence of in-the-wild exploitation, and Patchstack noted its customers received automatic virtual-patch protection ahead of the vendor fix.

MITRE ATT&CK techniques by tactic:

Execution

T1059.007 JavaScript; T1203 Exploitation for Client Execution; T1204.001 Malicious Link

Initial Access

T1190 Exploit Public-Facing Application; T1566.002 Spearphishing Link

Persistence

T1505.003 Web Shell

Defense Evasion

T1564 Hide Artifacts

Resource Development

T1583.006 Web Services; T1587.004 Exploits; T1588.006 Vulnerabilities

Remediation for Click2Shell WordPress RCE

Patches

• WordPress 7.1.1 (September 17, 2026) -- scopes the vulnerable jQuery selector to legitimate .theme DOM elements and escapes the URL-derived theme slug with $.escapeSelector() before it is used in selector construction

Immediate actions

• Update WordPress core to 7.1.1 or later immediately -- the release fixes the theme-preview selector-injection flaw plus ten other, unrelated security issues
• Audit installed themes for the Mobile Repair Zone theme (WordPress.org slug mobile-repair-zone); versions <=2.5.4 shipped an AJAX plugin-installer with no nonce or capability checks -- update to the current release or remove the theme if unused
• Audit ALL installed themes (active and inactive) for wp_ajax_* handlers that install or activate plugins without check_ajax_referer()/current_user_can() -- PWN AI identified 40+ third-party themes beyond Mobile Repair Zone sharing this pattern
• Enable the DISALLOW_FILE_MODS constant (or equivalent host-level file-modification restriction) as a compensating control against forced theme/plugin installation
• Instruct administrators not to click unsolicited or unfamiliar wp-admin links while authenticated to WordPress

Workarounds

• Disable theme/plugin installation via DISALLOW_FILE_MODS where administrators do not need to install themes directly from wp-admin
• Remove or update any installed theme/plugin whose AJAX handlers install remote packages without visible nonce/capability checks
• Patchstack virtual-patching customers received automatic protection ahead of the vendor fix, per Patchstack's disclosure write-up

Longer-term hardening

• Require nonce verification (check_ajax_referer) and capability checks (current_user_can) as a mandatory review gate on every wp_ajax_* handler shipped in themes/plugins before release
• Deploy a WAF rule flagging theme-install and customize_theme requests whose theme parameter contains CSS-selector metacharacters (e.g. ", ], >, *)
• Restrict the WordPress Administrator role to the minimum necessary accounts and monitor for unexpected theme or plugin installation events, including installs that never result in an active-theme change
• Enforce re-authentication or step-up confirmation for sensitive one-click admin actions such as theme installation

Affected and fixed versions

• WordPress — WordPress Core
  Vulnerable versions: < 7.1.1 (security backports issued back through the 4.7 branch)
  Fixed in: 7.1.1
• themagnifico52 — Mobile Repair Zone (WordPress theme)
  Vulnerable versions: 2.5.4
  Fixed in: Unconfirmed -- the theme was updated to 2.5.5 on WordPress.org on 2026-09-09, but the public changelog does not attribute this update to the AJAX nonce/capability fix

Timeline of Click2Shell WordPress RCE

• 2026-08-22 PWN AI researcher locked-ioc-11 reports the theme-preview selector-injection / silent forced-install flaw to the WordPress Security Team.
• 2026-09-01 PWN AI demonstrates the complete pre-activation chain, pairing the core forced-install primitive with the Mobile Repair Zone theme's unprotected AJAX plugin-installer to reach code execution, and separately catalogs 40+ other third-party themes with the same missing nonce/capability pattern.
• 2026-09-09 The Mobile Repair Zone theme is updated to version 2.5.5 on the WordPress.org repository; the public changelog does not confirm this update addresses the AJAX nonce/capability gap used in the PoC.
• 2026-09-17 WordPress 7.1.1 is released, escaping the URL-derived theme slug with $.escapeSelector() and scoping the vulnerable selector to legitimate .theme elements, alongside ten other unrelated security fixes.
• 2026-09-18 GBHackers separately publishes a roundup of all 11 security fixes in WordPress 7.1.1, naming the Click2Shell theme-install issue alongside ten unrelated stored-XSS, path-traversal, access-control, and information-disclosure fixes credited to other researchers.
• 2026-09-18 PWN AI and locked-ioc-11 publish the full Click2Shell technical disclosure at pwn.ai/blog/click2shell; The Hacker News, Patchstack, and BornCity publish coverage the same day, with The Hacker News reporting a 9.6 full-chain CVSS figure versus pwn.ai/Patchstack's 9.3.
• 2026-09-21 GBHackers publishes dedicated coverage of Click2Shell, the source article that triggered this threat record.

Sources cited for Click2Shell WordPress RCE

• Preauth WordPress Core Theme Preview Injection to RCE Chain (Click2Shell) pwn.ai · Research · 2026-09-18
• Click2Shell: The RCE WordPress 7.1.1 Just Patched patchstack.com · Vendor report · 2026-09-18
• WordPress 7.1.1 Maintenance and Security Release wordpress.org · Vendor report · 2026-09-17
• Mobile Repair Zone WordPress Theme wordpress.org · Vendor report · 2026-09-09
• click2shell-poc: PoC scripts for the Click2Shell WordPress pre-auth RCE chain GitHub · Proof of concept · 2026-09-18
• HackfutSecRoot/click2shell -- WordPress Pre-Auth RCE Chain (PoC) GitHub · Proof of concept · 2026-09-18
• Click2Shell-Sicherheitslücke; zeitnah auf WordPress 7.1.1 aktualisieren borncity.com · Blog · 2026-09-18
• Click2Shell WordPress Flaw gbhackers.com · News · 2026-09-21
• New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution The Hacker News · News · 2026-09-18
• WordPress 7.1.1 Fixes 11 Security Flaws Including Stored XSS and Path Traversal gbhackers.com · News · 2026-09-18

More in vulnerability

• Siemens SSA-698820: Multiple Fortigate NGFW Vulnerabilities (before V7.4.4) on RUGGEDCOM APE1808 Devices
• Siemens SSA-827968: Multiple Vulnerabilities in Nozomi Guardian/CMC < V26.2.0 on RUGGEDCOM APE1808 (17 CVEs)
• Local Privilege Escalation in Siemens TeleControl Server Basic before V3.1.2.4 (CVE-2025-40942)
• Privilege Escalation in WIBU CodeMeter Runtime Affecting Siemens Desigo CC Product Family and SENTRON Powermanager (CVE-2025-47809)
• Siemens SSA-282044: DLL Hijacking in Siemens Web Installer (SIWA) used by Online Software Delivery (CVE-2025-30033)

Previous and next in vulnerability

• F5 BIG-IP DNS Denial of Service via BIND DNSSEC Random Subdomain Attack (CVE-2026-11622) Previous report
• Zyxel GS1900 Series Switches Stack-Based Buffer Overflow (CVE-2026-7273) Actively Exploited by Kapibala/Red Heron in Global 996-Device Campaign — Added to CISA KEV Next report