Click2Shell: the WordPress attack chain that turned one admin click into a remote shell

Security researcher Paulos Yibelo of pwn.ai reported a vulnerability, named Click2Shell, that chains together CSRF and a JavaScript sanitization mismatch to turn a single administrator click into full remote code execution (per Patchstack’s writeup). It was fixed in WordPress 7.1.1, released September 17 — the kind of fix proactive WordPress security maintenance is built to apply the day it ships, not weeks later.

How it worked

• WordPress lets admins install or preview themes from the WordPress.org catalog without leaving wp-admin, passing the theme slug through the URL
• The server sanitizes that value one way; the admin page’s own JavaScript reads it another way, and drops it straight into a jQuery selector — the mismatch let a crafted URL silently install an unrelated, attacker-chosen theme
• The attacker’s theme included an AJAX handler with no nonce or capability checks, so once an admin previewed it in the Customizer, it would download and execute an attacker-supplied ZIP as if it were a real plugin — that’s the “shell” in Click2Shell

Why it matters for client sites, even though it’s already patched

• This requires an administrator to click a specific crafted link — it can’t be triggered by a regular visitor, and it can’t be triggered by a lower-privileged Author or Editor account
• That makes it a phishing-adjacent risk, not a drive-by one: the technical fix ships in 7.1.1, but the underlying lesson — admins shouldn’t click unexpected links, even ones that look like they come from inside wp-admin — is worth a line in your next client update
• No in-the-wild exploitation was reported before the patch; it was responsibly disclosed and fixed in the same release cycle

What this means for Codelibry clients

If you’re on one of our maintenance plans, this fix is already applied and logged in your monthly maintenance report — you don’t need to do anything about Click2Shell specifically. What’s genuinely worth doing regardless of your update status: a quick reminder to your team not to click unexpected links inside wp-admin, since that’s the actual trigger here. If you’re not on a maintenance plan, this is the kind of vulnerability that’s easy to miss precisely because the fix ships quietly inside a routine-looking release.

Source: Patchstack