pwn.ai reported Click2Shell, a WordPress core flaw fixed in WordPress 7.1.1 on September 17, that lets a crafted link opened by a logged-in administrator install a real theme from the official WordPress.org directory without clicking Install. The theme stays switched off, so the site can look unchanged while the install has already happened.
The bug works because WordPress and the browser interpret the same link differently: one side sees a normal theme name, while the other reuses the attacker’s text to trigger the Install button. That means the admin’s own session supplies the permission and security token, and if the chosen theme has its own flaw, pwn.ai showed the chain can reach server code execution.
For WordPress sites where admins may open links while signed in, the exposure is a stealthy persistence path inside the core install flow, not just a visible theme swap. What remains after the fix is the trust problem: a real theme from the official directory can still be the vehicle if a separate theme bug is present.
WordPress Click2Shell flaw lets hackers execute PHP on the server
Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed 'Click2Shell' that affects the platform's Core component.