WordPress shipped version 7.1.1 on 17 September, and it deserves more attention than a point release usually gets. The update closes a chain that turns a single clicked link into attacker-controlled PHP running on the web server, with no password and no account needed.
The one condition is that somebody with administrator rights has to open the link while logged in. In practice that means a phishing email, or a cross-site scripting bug elsewhere on the same site.
A theme installer that could be steered
Paulos Yibelo of pwn.ai reported the chain, and PWNAI Research published the full technical disclosure on 18 September under the name Click2Shell. It opens with a crafted theme preview URL carrying a CSS selector injection payload. The WordPress.org API tidies the malicious value into a legitimate theme slug, but browser-side JavaScript preserves the original characters and feeds them into a jQuery selector. That injected selector reaches the genuine Install button on the page and trips it, so a theme from the official WordPress.org catalog installs itself without the administrator agreeing to anything.
The second half is what turns an unwanted install into a server compromise. An inactive theme's PHP still loads during Customizer preview operations, and unprotected AJAX handlers inside such a theme will fetch and execute attacker-supplied plugin code. The selector injection picks the theme, and the theme runs the payload.
Patch to 7.1.1, then block file changes
Every release before 7.1.1 is affected. HKCERT's bulletin, which rates the issue High Risk, lists the affected line as 4.7 through 7.0 and points to the WordPress 7.1.1 release notes for the fix. The patch constrains the selector match to an actual theme card and escapes the URL-derived slug before it enters selector syntax. No CVE had been assigned when the research went out, and WordPress indicated that one would follow.
Patchstack's Chazz Wolcott, writing the chain up the same day, notes that sites running with the DISALLOW_FILE_MODS constant enabled take reduced impact, since WordPress will not install themes or plugins at all in that configuration. That is worth setting on any site whose administrators never install anything from the dashboard.
Working proof-of-concept code is public for both the cross-site scripting step and the full execution chain, which shortens the runway between disclosure and opportunistic use. Core bugs of this class are rarer than the plugin flaws that dominate the ecosystem's bad weeks, and the ones that reach code execution usually arrive through an extension: a comment-handling bug in one events plugin exposed roughly 600,000 sites earlier this month, and attackers have been stealing records straight out of WordPress-backed government sites. This one sits in core, and the only thing between a crafted link and a shell is an administrator who does not click it.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.