Click2Shell Exposure: What 7.9 Million WordPress Assets Do and Do Not Tell You

On September 21, 2026, a security disclosure revealed a critical vulnerability in WordPress Core known as Click2Shell. The exploit involves a crafted link that, when visited by an administrator, installs a malicious theme automatically. This theme's unprotected AJAX handler then pulls and executes attacker PHP from a remote package. The vulnerability was patched in WordPress version 7.1.1.

According to ZoomEye, an internet search engine for Internet of Things (IoT) devices, there were 7,945,496 matching WordPress assets globally as of September 22, 2026. However, this figure is misleading. It represents indexed product assets, not confirmed vulnerable hosts. The chain has an authentication-shaped gate, requiring a logged-in administrator to visit an attacker-chosen URL before any code runs. This means that even if a WordPress instance is indexed, it does not necessarily mean it is vulnerable.

The exposure surface consists of two layers: the Core layer, which affects all versions before 7.1.1, and the Theme layer, which involves unprotected AJAX endpoints in specific themes. Even if the core is patched, a vulnerable theme can still pose a risk if an attacker can get that theme loaded during a Customizer preview. Therefore, a single product fingerprint cannot represent the entire exposure surface. Researchers found no in-the-wild exploitation, suggesting that the vulnerability has not been actively targeted yet.