🔴 Click2Shell is the new heart attack for WordPress! One click to take over your server

A vulnerability called Click2Shell has been discovered in WordPress core, which allows attackers to forcibly install themes from the official WordPress.org catalog.

Experts warn that, combined with a vulnerability in the installed theme, this issue can be exploited to remotely execute arbitrary PHP code on the server.

The Click2Shell vulnerability was reported by Paulos Yibelo, a researcher at pwn.ai, who notified WordPress developers of the issue on August 22, 2026. The fix was released on September 17, 2026, and is included in WordPress 7.1.1.