Build1 publisher2 min readPublished
Click2Shell turns a 5.3-rated WordPress selector injection into PHP on the server
The WordPress Core bug alone scores 5.3. In a research proof of concept it installs an official catalog theme inside the administrator's browser, the Customizer preview loads that theme's functions.php, and a second bug runs the attacker's PHP.
The Engineer · Build desk
What happened
- A dev.to writeup dated 18 September 2026, sourced to pwn.ai, sets out a WordPress chain called Click2Shell that starts with a Core theme preview injection and ends with PHP running on the server.
- The official CVSS score for the WordPress Core issue on its own is 5.3, described as Moderate, while the writeup rates the chained outcome High.
- pwn.ai says it verified arbitrary PHP execution in a research environment, no CVE has been assigned, and no active exploitation in the wild has been reported.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint A core CVSS score measures core in isolation. Whether a site reaches PHP execution depends on a property of the themes it has or can install, and a 5.3 on the core entry cannot express that.
- exposure The account that runs the payload is the PHP worker, so wp-config.php, the database credentials and any host file that account can read come into range without the attacker ever holding a WordPress login.
- decision Patching is a point release on whichever branch a site runs. The open decision is whether the web server keeps write access to wp-content/themes and whether the host is allowed to fetch archives from the internet at all.
- contradiction BleepingComputer's headline puts PHP execution on the flaw itself; the core advisory scores the injection at 5.3. Which number an operator inherits depends on whether the theme half of the chain is counted.
WordPress's Themes API normalizes the crafted input to a regular slug, and the same string is reinterpreted as a jQuery selector in the administrator's browser [5]. The validation ran on the server, and the dangerous use comes later, in the page. Nothing after that has to be forged: WordPress's own JavaScript clicks the legitimate install control, so the install runs in the administrator's session and the theme arrives from the official WordPress.org catalog [6]. The attacker needs only an administrator who opens a link from an external page or message, and no WordPress account of their own [10].
The theme lands inactive [6]. Step two is a request from the attacker's page to admin-ajax.php carrying Customizer parameters, and that loads the inactive theme's functions.php [7]. Preview-before-activate is what the Customizer is for, and an inactive theme gets its PHP loaded during it. In the proof of concept that theme is Mobile Repair Zone 2.5.4 [11]; its AJAX handler fetches, extracts and includes an attacker-specified plugin ZIP, and the payload executes with the privileges of the PHP worker [8][9].
For the chain to reach PHP on a given site, core has to be unpatched on one of the branches listed in GHSA-5qf7-2r5p-ppj8 [11], an administrator has to open the URL and log in if prompted [6], and a theme has to load during preview and allow an attacker-specified plugin [12]. Most sites match the first two. The third decides exposure, and the writeup names one theme at one version [11].
The fix was backported across branches 7.1 through 4.8, with patched releases including 7.1.1, 7.0.5, 6.9.8 and 4.8.31 [13].
Removing unnecessary themes sits on the mitigation list next to file permissions, a WAF and outbound traffic controls [14]. Removal thins what is already on disk. Step one still works, because the injection installs a theme from the catalog on demand while the administrator sees what looks like a normal login screen or theme preview [21][19]. The two controls that stop the later steps are a themes directory that is read-only to the web server and egress rules that block the host from fetching a plugin ZIP from an external URL [14][8].
How far it goes past WordPress depends on the service account. The writeup lists reading wp-config.php and database credentials, modification of settings, content and users, and spread to files and secrets on the host reachable by the same account [15]. For anyone checking after the fact, the artifacts are theme queries in theme-install.php, wp_customize parameters in admin-ajax.php, and HTTP or DNS requests for external plugin ZIPs [20], plus new directories under wp-content/themes for unapproved themes [16].
What to watch
- Whether a CVE is assigned and whether the branch list in GHSA-5qf7-2r5p-ppj8 grows beyond 4.8 through 7.1.
- Whether any theme other than Mobile Repair Zone 2.5.4 is shown to load during preview and accept an attacker-specified plugin ZIP.
- The first report of exploitation in the wild. The writeup says there has not been one.