CYBERSECURITYTRACKER
Permanent story citation

Click2Shell: The RCE WordPress 7.1.1 Just Patched

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 7836

As cited

Copy frozen at (site build).

vulnerabilities

Click2Shell: The RCE WordPress 7.1.1 Just Patched

WordPress 7.1.1 patched Click2Shell, a remote code execution (RCE) vulnerability that chains cross-site request forgery (CSRF) with selector injection to achieve arbitrary code execution. The flaw exploited a mismatch in how server-side and client-side code handled theme slugs, allowing an attacker to silently install a malicious theme and trigger its code through the WordPress Customizer. The patch sanitizes the slug input on the frontend using jQuery escapeSelector and restricts the selector scope to legitimate theme elements.

Why it matters: WordPress administrators must update immediately; attackers can trigger RCE by tricking an admin into clicking a malicious link while logged in or by exploiting existing XSS vulnerabilities to auto-execute the attack in the admin's browser.

VendorsWordPress
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary