WordPress 7.1.1 Fixes Click2Shell and Comment2Shell Code-Execution Paths
Summary
WordPress 7.1.1 fixes 11 vulnerabilities, including two attack paths that can lead to PHP code execution by abusing an administrator’s existing session. Upgrade to 7.1.1 or later and review administrative workflows.
Key points
- WordPress 7.1.1, released September 17, 2026, addresses 11 security vulnerabilities.
- Click2Shell uses a crafted link to trigger theme installation and preview in a logged-in administrator’s session; exploitation may require a vulnerable theme.
- Comment2Shell (CVE-2026-93485) uses a malicious comment to execute JavaScript when an administrator views the page, potentially leading to a web shell.
- Both attack paths rely on an administrator’s existing session and do not require stealing credentials; each requires the administrator to open a crafted link or view a page containing the comment.
- Researchers published Click2Shell proof-of-concept code on September 18 and Comment2Shell technical details on September 21.
- Upgrade to WordPress 7.1.1 or later; review theme use and comment moderation, and monitor for unexpected themes, plugins, admin-account changes, and PHP files.
Article Details
- Vulnerability Types
- Stored cross-site scripting (XSS)
- Unauthorized installation and preview of an inactive theme
- Exploitation Status
- reported
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Remove themes that are no longer required.
- Review comment moderation practices and identify pathways through which untrusted content can be published.
- Separate WordPress administration from daily browsing, limit theme installation permissions and privileged accounts, and carefully review user-generated content.
MITRE ATT&CK
T1059.004 · Unix ShellComment2Shell's malicious comment executes JavaScript when rendered in an administrator's browser.T1059.007 · JavaScriptThe demonstrated attack chains execute attacker-supplied PHP code on the WordPress server.T1189 · Drive-by CompromiseClick2Shell uses a crafted URL that a logged-in administrator must visit to trigger the attack.T1505.003 · Web ShellThe Comment2Shell PoC uploads a malicious plugin containing a web shell.
CVE
Vendors
Products
Mobile Repair ZoneThe published POC used Mobile Repair Zone 2.5.4, although researchers reported identifying similar conditions in more than 40 third-party themes.WordPressWordPress 7.1.1 fixes 11 vulnerabilities, including Click2Shell and Comment2Shell, two vulnerabilities that researchers demonstrated can be leveraged to execute attacker-supplied PHP code on a WordPress server.