{"id":11951,"date":"2026-09-18T18:00:00","date_gmt":"2026-09-19T00:00:00","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-103-click2shell-in-wordpress-allows-forced-theme-installation-and-can-be-chained-to-rce\/"},"modified":"2026-09-29T09:59:06","modified_gmt":"2026-09-29T15:59:06","slug":"alert-2026-103-click2shell-in-wordpress-allows-forced-theme-installation-and-can-be-chained-to-rce","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-103-click2shell-in-wordpress-allows-forced-theme-installation-and-can-be-chained-to-rce\/","title":{"rendered":"Alert 2026-103 Click2Shell in WordPress allows forced theme installation and can be chained to RCE"},"content":{"rendered":"\n

Affected product(s):<\/h2>\n\n
Product<\/strong><\/td>Affected versions<\/strong><\/td>Fixed version<\/strong><\/td><\/tr>
WordPress Core<\/strong><\/td>WordPress 6.0 up to versions prior to the corresponding security patch<\/td>WordPress 7.1.1 or equivalent security update for the supported branch<\/td><\/tr>
WordPress Core \u2014 older branches with security support<\/strong><\/td>Supported versions since WordPress 4.7 affected by the issue<\/td>Maintenance\/security update published on September 17, 2026<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

* WordPress confirmed that the issue is present from version 6.0<\/strong> up to versions immediately preceding the fix. The security update of September 17, 2026 includes fixes for supported branches since WordPress 4.7<\/p>\n\n

Description<\/h2>\n\n

A vulnerability was identified in the WordPress core that allows a specially crafted URL to force the installation and preview of a legitimate theme from the WordPress.org repository when an authenticated administrator opens the link. The vulnerability, named Click2Shell<\/strong>, was fixed in WordPress 7.1.1<\/strong> and in the equivalent updates for supported branches. There is no CVE published yet, but a score of 9.6 (critical) is estimated.<\/p>\n\n

Click2Shell is a URL-induced forced theme installation vulnerability. The issue occurs because two WordPress components interpret a parameter included in a manipulated URL differently: the WordPress.org repository interprets it as the normal name of a valid theme, while the administrator’s browser reuses the original content \u2014including additional characters\u2014 within JavaScript code used to locate an element on the page.<\/p>\n\n

The use of specially prepared characters allows the browser selector to point to the Install<\/strong> button and the WordPress script itself to execute the installation action. Since the administrator already has an active session, the browser automatically includes their permissions and security token (nonce<\/em>), so the attacker does not need to know credentials or obtain that token.<\/p>\n\n

Click2Shell should not be confused with wp2shell<\/strong>, another WordPress Core vulnerability disclosed in July 2026. wp2shell does not require login or user interaction, and CISA included it as an actively exploited vulnerability; Click2Shell, on the other hand, requires an authenticated administrator to open a specially crafted link and has no known active exploitation.<\/p>\n\n

Solution<\/h2>\n\n

The official solution is to update WordPress to 7.1.1<\/strong> or to the security update published for the corresponding supported branch. The update can be performed from the administration panel at Dashboard > Updates > Update Now<\/strong>, or via the installation package available from WordPress.org.<\/p>\n\n

There is no standalone workaround<\/em> that eliminates the URL interpretation flaw. Disabling themes, restricting the administration panel, and avoiding suspicious links are temporary controls that reduce the likelihood of exploitation, but they do not replace applying the patch.<\/p>\n\n

After updating, it is recommended to keep only necessary themes and plugins, apply security updates promptly, and use additional controls to protect administrative sessions.<\/p>\n\n

Additional information:<\/h2>\n\n