Finding WordPress Click2Shell Exposure Starts With Knowing Where WordPress Runs
Finding WordPress Click2Shell Exposure Starts With Knowing Where WordPress Runs On September 21, 2026, security researchers disclosed Click2Shell, an unauthenticated remote code execution chain in WordPress Core. An attacker needs no WordPress account. A single visit by a logged-in administrator to a crafted link is enough: the browser installs a catalog theme on its own, and the theme's…
On September 21, 2026, security researchers unveiled Click2Shell, an unauthenticated remote code execution vulnerability in WordPress Core. With no WordPress account required, a single visit from a logged-in administrator to a crafted link is sufficient. The browser installs a theme on its own, then the theme's unprotected AJAX endpoint downloads and executes attacker-controlled PHP.
WordPress patched the core parser flaw in version 7.1.1, though no CVE identifier has been published yet, and researchers confirmed no exploitation in the wild at the time of discovery. To prioritize a fix, organizations first need to understand where WordPress actually runs within their environments. With 7,945,496 matching assets worldwide, the scale of potential vulnerability is immense.
However, not all of these instances are vulnerable, nor are they already attacked. ZoomEye played a crucial role in this discovery by providing verifiable asset identification through fingerprint queries. While the count represents a point-in-time observation and does not confirm specific patch levels, it serves as a critical starting point for patch tracking, theme audits, and incident review.
For organizations, identifying all WordPress instances, especially those running forgotten or unofficial themes, is the first essential step in managing the risk posed by Click2Shell and future vulnerabilities.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.