#WordPress admin clicks a link. WordPress clicks Install.
“Click2Shell” abuses the admin’s logged-in session to silently install an attacker-chosen theme. Chain it with a vulnerable theme: server-side PHP execution.
Patch WordPress core to 7.1.1 now! 👇
https://thehackernews.com/2026/09/new-wordpress-click2shell-flaw-forces.html
Sam Stepanyan :verified: 🐘
npub1gr…9gp67
2026-09-19 16:07:05 UTC
Author Public Key
npub1gr8f0c2al23r8wpv2v7vt2na36g3xnpz06pceqhrysmlg8gahyjqp9gp67Seen on
wss://relay.momostr.pinkPublished at
2026-09-19 16:07:05 UTCEvent JSON
{
"id": "410e90787156293af278fe344f5c2090d635d9dfd221093ec2641f3f15ca55f2",
"pubkey": "40ce97e15dfaa233b82c533cc5aa7d8e91134c227e838c82e32437f41d1db924",
"created_at": 1789834025,
"kind": 1,
"tags": [
[
"t",
"wordpress"
],
[
"proxy",
"https://infosec.exchange/@securestep9/117298562681538659",
"web"
],
[
"proxy",
"https://infosec.exchange/users/securestep9/statuses/117298562681538659",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/securestep9/statuses/117298562681538659",
"pink.momostr"
],
[
"-"
]
],
"content": "#WordPress admin clicks a link. WordPress clicks Install.\n\n“Click2Shell” abuses the admin’s logged-in session to silently install an attacker-chosen theme. Chain it with a vulnerable theme: server-side PHP execution.\n\nPatch WordPress core to 7.1.1 now! 👇\nhttps://thehackernews.com/2026/09/new-wordpress-click2shell-flaw-forces.html",
"sig": "8cb5fb7a10442bb25ba61034c0b5435ebf2f2a009e4375bc341a13cf6e2ab13b8bd55d4fa2dd7c36670b873accef9f2b0e6db7d9c1f1f14e0d2492a332e5d38c"
}