GoKawiilWordPress patches 'Click2Shell' CSRF flaw enabling remote code execution
Researcher Paulos Yibelo of pwn.ai disclosed a WordPress Core vulnerability, called Click2Shell, that chains a cross-site request forgery bug with the theme Customizer preview to achieve remote PHP execution. The flaw lets an attacker trick a logged-in administrator into visiting a malicious link, silently installing a theme from the WordPress.org catalog and running arbitrary PHP through the Customizer preview even before activation. WordPress fixed the issue in version 7.1.1 after it was reported in late August.
GoKawiil's interpretation of the reporting above, not reported fact.
Because the exploit requires no authentication from the attacker and only relies on an admin clicking a crafted link, it lowers the bar for compromising sites that haven't updated. Successful exploitation could expose database credentials in wp-config.php, allow creation of rogue admin accounts, or let attackers plant persistent backdoors—serious risks given WordPress powers a huge share of the web.
- Click2Shell chains a CSRF flaw with theme Customizer previews to run PHP on the server.
- No attacker authentication is needed, but a logged-in admin must click a malicious link.
- WordPress 7.1.1 patches the flaw; sites should update immediately to avoid credential theft or takeover.
Source: bleepingcomputer.com, 2026-09-21
Published there as: “WordPress Click2Shell flaw lets hackers execute PHP on the server”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.