Click2Shell is public: get WordPress fleets onto 7.1.1

Blog

WordPress 7.1.1 landed last week as a security and maintenance release. That already mattered. What changed yesterday is the public proof-of-concept for one of the fixed issues: a chain researchers are calling Click2Shell.

What Click2Shell actually is

It is not a drive-by that hits every visitor. The reported chain is a Core CSRF flaw in theme-preview handling on WordPress 7.1.0 and earlier. A crafted URL can push a logged-in administrator into installing a theme from the WordPress.org catalog and running PHP through Customizer preview of that theme — including an inactive one.

Key constraints from the public write-ups:

  • The attacker does not need their own admin account on your site.
  • A logged-in administrator still has to visit the crafted link (phishing, social engineering, or an existing XSS that fires in an admin session).
  • Patchstack notes Author and Editor roles lack the capability to install themes, so they cannot complete the chain on their own.
  • Sites with DISALLOW_FILE_MODS enabled cannot be forced through the install step — useful as a temporary brake, not a substitute for the Core update.

WordPress fixed the Core side in 7.1.1 by escaping the theme slug before it hits the jQuery selector and limiting that selector to real theme cards. Matching security fixes are being backported across supported older branches as they are ready.

With technical detail and a PoC in the open, the practical advice is simple: treat any site still on 7.1.0 or earlier as behind.

Fleet check in CMS Inspect

If you only manage one site, update from Dashboard → Updates and move on. If you manage a fleet — agencies, hosting teams, in-house ops — the failure mode is usually the site nobody opened this week.

CMS Inspect is built for that loop on WordPress and Joomla:

  1. See which sites are still behind on core.
  2. Queue and run updates with clearer state and retry visibility.
  3. Keep an audit trail of what changed so you are not reconstructing the morning from memory.
  4. Pair the update run with uptime history and Drive/Dropbox database backups when something goes sideways.

Core access is free. Advanced ops are $1 per active site per month.

What to do this morning

  1. Confirm every WordPress site you care about is on 7.1.1 (or the matching security backport for its branch).
  2. If you cannot update a site immediately, enable DISALLOW_FILE_MODS as a stopgap and schedule the Core update.
  3. Remind admins not to click unexpected “preview this theme” or “check this layout” links while logged in.
  4. For multi-site work, run the version check and update queue from one place instead of logging into each dashboard.

Click2Shell is a good reminder that “fixed last week” and “patched on every client site” are not the same sentence. Close that gap today.

More on CMS Inspect: https://cmsinspect.com

Sources for the public details: WordPress 7.1.1 release notes; BleepingComputer coverage of the Click2Shell PoC (21 Sep 2026); Patchstack analysis of the admin-trigger and DISALLOW_FILE_MODS mitigation.