{
  "id": 10155785,
  "title": "Click2Shell Exposure: What 7.9 Million WordPress Assets Do and Do Not Tell You",
  "url": "https://urgent.news/2026/09/27/click2shell-exposure-what-7-9-million-wordpress-assets-do-and-do-not",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-27T06:20:15.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/stark_zhuang_df5076f35c68/click2shell-exposure-what-79-million-wordpress-assets-do-and-do-not-tell-you-1gka"
  },
  "original_language": "en",
  "account": "On September 21, 2026, a security disclosure revealed a critical vulnerability in WordPress Core known as Click2Shell. The exploit involves a crafted link that, when visited by an administrator, installs a malicious theme automatically. This theme's unprotected AJAX handler then pulls and executes attacker PHP from a remote package. The vulnerability was patched in WordPress version 7.1.1.\n\nAccording to ZoomEye, an internet search engine for Internet of Things (IoT) devices, there were 7,945,496 matching WordPress assets globally as of September 22, 2026. However, this figure is misleading. It represents indexed product assets, not confirmed vulnerable hosts. The chain has an authentication-shaped gate, requiring a logged-in administrator to visit an attacker-chosen URL before any code runs. This means that even if a WordPress instance is indexed, it does not necessarily mean it is vulnerable.\n\nThe exposure surface consists of two layers: the Core layer, which affects all versions before 7.1.1, and the Theme layer, which involves unprotected AJAX endpoints in specific themes. Even if the core is patched, a vulnerable theme can still pose a risk if an attacker can get that theme loaded during a Customizer preview. Therefore, a single product fingerprint cannot represent the entire exposure surface. Researchers found no in-the-wild exploitation, suggesting that the vulnerability has not been actively targeted yet.",
  "summary": "Click2Shell Exposure: What 7.9 Million WordPress Assets Do and Do Not Tell You The Click2Shell disclosure on September 21, 2026 described an unauthenticated RCE chain in WordPress Core: a crafted link makes a logged-in administrator's browser install a catalog theme automatically, then the theme's unprotected AJAX handler pulls attacker PHP from a remote package and executes it. WordPress shipped…",
  "key_points": [
    "Click2Shell vulnerability discovered in WordPress Core, patched in version 7.1.1",
    "7,945,496 WordPress assets indexed globally, but not all vulnerable",
    "Authentication gate required for exploitation, posing layered exposure risk"
  ],
  "editors_take": "The large number of potentially exposed WordPress assets belies a more complex vulnerability landscape, where administrators' actions and specific themes can mitigate or exacerbate risk, even after patching.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}