WordPress Click2Shell bug allows remote code execution via theme preview
Admins on unpatched sites can be tricked into installing themes that execute PHP, exposing files, data and accounts.
Two recent flaws in WordPress Core highlight urgent upgrade needs for site owners and plugin/theme developers. The newly detailed Click2Shell CSRF chain, fixed in WordPress 7.1.1, lets an unauthenticated attacker trick a logged‑in admin into auto‑installing a theme and executing arbitrary PHP on the server. Click2Shell abuses how theme preview URLs are parsed in WordPress.org’s Themes API and in admin‑side JavaScript, enabling code execution even from an inactive theme during Customizer preview. Separately, attackers are already exploiting CVE‑2026‑87902, an unauthenticated path traversal bug rated 9.2/10, to drop PHP files that run shell commands, with fixes shipped in WordPress 7.1.2 and backported to versions as old as 4.7. Administrators are advised to move quickly to 7.1.1 and 7.1.2 (or relevant backports), enable hardening options like DISALLOW_FILE_MODS where possible, and review logs for suspicious theme installs and pearcmd‑based payloads under /tmp or /var/tmp.
Why it matters
The Click2Shell flaw turns a single admin click on a crafted URL into full server compromise on unpatched WordPress sites. Because it can auto-install a theme and run its PHP during preview, attackers can modify or delete files, access user data and configuration, and create rogue admin accounts or inject scripts. Only administrators can trigger the chain, but they do not need to explicitly install a theme, which raises the risk of successful social engineering attacks.
Signal or noise?
Does this story matter, or is it hype? Decide before you see what everyone else thinks.