WordPress 7.1.1 fixes two paths to shell

Threat summary

On September 17, 2026, WordPress released version 7.1.1 to address 11 security vulnerabilities. Researchers subsequently published proof-of-concept (PoC) code and technical details for two of the issues, now dubbed Click2Shell and Comment2Shell.

Click2Shell PoC code was released on September 18, and Comment2Shell technical details were published on September 21. Researchers demonstrated that both vulnerabilities can be leveraged to execute attacker-supplied PHP code on a WordPress server.

Both vulnerabilities abuse legitimate WordPress functionality and an administrator's existing privileges rather than compromising administrator credentials. Successful exploitation could result in installation of malicious components, execution of PHP code, and compromise of the affected WordPress instance. The impact depends on the permissions available to the WordPress server process and the surrounding hosting environment.

Click2Shell

Click2Shell is a researcher-named attack chain affecting WordPress theme installation and preview functionality. A specially crafted URL can cause a logged-in administrator's browser to automatically install and preview a theme from the official WordPress.org repository. Because the action is performed using the administrator's existing session, the threat actor does not require a WordPress account.

The underlying WordPress Core flaw enables unauthorized installation and preview of an inactive theme. Researchers demonstrated that if the installed theme contains a separate vulnerability, the attack can progress beyond theme installation and result in compromise of the WordPress server. The published POC used Mobile Repair Zone 2.5.4, although researchers reported identifying similar conditions in more than 40 third-party themes.

The attack path is remote, does not require attacker authentication, and requires a logged-in administrator to visit a crafted link. No Common Vulnerabilities and Exposures (CVE) identifier had been assigned to Click2Shell at the time of disclosure.

Comment2Shell (CVE-2026-93485)

Comment2Shell is a stored cross-site scripting (XSS) vulnerability tracked as CVE-2026-93485. The flaw affects the WordPress wpautop() formatting function and allows a specially crafted comment to become executable JavaScript when rendered in a browser.

The vulnerability allows an unauthenticated threat actor to place malicious JavaScript in a comment. When a logged-in administrator views the affected page, the script executes using the administrator's existing permissions. In the published PoC, the script uploads a malicious plugin containing a web shell, resulting in execution of attacker-supplied PHP code on the server. Unlike Click2Shell, the demonstrated attack does not rely on a second vulnerable theme.

The attack begins with a malicious comment and requires a logged-in administrator to view the page containing it. Researchers noted that exploitation is influenced by site configuration, theme usage, and comment moderation practices.

Analysis

Both vulnerabilities highlight how trusted WordPress functionality can be abused to reach code execution without directly compromising an administrator account. In both attack chains, the threat actor relies on WordPress to perform privileged actions using an administrator's existing session. The administrator is not required to enter credentials, approve a plugin installation, or manually execute code. Instead, legitimate WordPress features are leveraged to perform those actions on the threat actor's behalf.

Both vulnerabilities ultimately target WordPress administrators, rather than the WordPress platform itself. Click2Shell relies on a logged-in administrator opening a crafted link, while Comment2Shell relies on a logged-in administrator viewing a page containing a malicious comment. As a result, environments with multiple administrators, delegated website management responsibilities, or routine content moderation activities face greater exposure to these attack paths.

For Click2Shell, environments where administrators regularly manage WordPress while also browsing email, documentation portals, collaboration tools, ticketing systems, or other websites provide additional opportunities for a crafted link to be delivered and opened. The demonstrated attack begins when a logged-in administrator visits the malicious URL.

For Comment2Shell, exposure is influenced by how organizations handle user-generated content. Sites that allow public comments and where administrators routinely review published comments, forum posts, or community content provide additional opportunities for a malicious comment to be rendered in an administrator's browser and trigger the demonstrated attack chain.

Mitigations

• Upgrading affected WordPress installations to version 7.1.1 or a later supported release removes the vulnerable functionality used in both attack paths.

• Removing themes that are no longer required reduces the amount of third-party code available to threat actors and limits opportunities to leverage vulnerable theme functionality through the Click2Shell attack chain.

• Examining comment moderation practices and identifying pathways through which untrusted content can be published helps reduce exposure to malicious comments and the Comment2Shell attack path.

• Monitoring for unexpected theme installations, newly deployed plugins, changes to admin accounts, and unfamiliar PHP files can help identify systems where either attack path has progressed beyond the initial vulnerability.

• Separating WordPress administration from daily browsing activities, limiting theme installation permissions, reducing the number of privileged accounts, and carefully reviewing user-generated content can help reduce opportunities for exploitation even after vulnerable functionality has been patched.

Stay on top of emerging threats like this.

Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities. 

Sign up