Loading story…
A WordPress Core theme-preview selector-injection flaw, dubbed Click2Shell, can be exploited through a crafted link visited by a logged-in administrator. The attack silently installs an attacker-selected inactive theme from the official WordPress.org directory; if that theme exposes insecure pre-activation functionality, the attacker can achieve remote code execution. Researchers demonstrated the chain using Mobile Repair Zone 2.5.4, whose Customizer-preview AJAX handler could download, unpack, and execute attacker-controlled PHP. No in-the-wild exploitation was reported at disclosure.
WordPress addressed the Core flaw in version 7.1.1, including changeset 63664, and administrators should update immediately. A proposed Nuclei template, wordpress-click2shell, detected the issue on a tested WordPress 7.1 container image and did not flag WordPress 7.1.1, providing a means to identify unpatched deployments. Organizations should also review administrator session protections and restrict unnecessary themes and theme-installation privileges, since exploitation depends on an administrator loading the malicious URL.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
pwn.ai published a technical analysis of Click2Shell, rating the standalone forced-install issue High (CVSS 7.1) and the demonstrated remote-code-execution chain Critical. Public reporting at disclosure found no evidence of exploitation in the wild.
WordPress released version 7.1.1 to address the Click2Shell Core selector-injection flaw. Changeset 63664 constrained theme-card matching and applied jQuery escapeSelector() to the URL-derived slug; fixes were also being backported to supported branches through version 4.7 where needed.
Researchers delivered the complete pre-activation Click2Shell chain, demonstrating remote code execution with the Mobile Repair Zone 2.5.4 theme. Its Customizer-preview AJAX handler could download, unpack, and load attacker-controlled PHP without nonce validation or capability checks.
Researchers reported the WordPress theme-preview selector-injection and forced-install behavior that underpins the Click2Shell chain. The issue could cause a logged-in administrator visiting a crafted URL to install and preview an attacker-selected inactive theme from WordPress.org.
A WordPress core vulnerability chain dubbed wp2shell was disclosed, combining a REST API batch-processing route-confusion issue with SQL injection that could enable unauthenticated remote code execution. The WordPress Security Team released updates for affected versions and enabled automatic security updates for many sites.
A report described a potential SQL injection issue in WordPress Core's WP_Query handling of the `author__not_in` parameter, where unvalidated array elements could be inserted into a SQL `NOT IN` clause. The proposed remediation converts each supplied author ID with `intval()` before query construction.
A GitHub pull request added the `wordpress-click2shell` Nuclei detection template. Testing produced a finding on WordPress 7.1 and no finding on WordPress 7.1.1, indicating the template distinguished the tested vulnerable and fixed versions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcegithub.com
Open sourcemedium.com
Open sourcecvereports.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WordPress released security updates for two core vulnerabilities, **CVE-2026-63030** and **CVE-2026-60137**, that can be chained to make a blind SQL injection remotely reachable without authentication and, in some cases, lead to **remote code execution**. The issue, dubbed **`wp2shell`**, stems from REST API batch-route confusion in the `/wp-json/batch/v1` endpoint combined with SQL injection, affecting WordPress versions **6.9.0 through 6.9.4** and **7.0.0 through 7.0.1**. Researchers said the route-confusion flaw carries a **CVSS 9.8** rating, while the second SQL injection bug is rated **CVSS 5.9**. WordPress fixed the flaws in **6.9.5** and **7.0.2**, and also backported the SQL injection fix to **6.8.6**. The vulnerabilities were reported by Adam Kues of Assetnote through the WordPress HackerOne program, and while exploitation had not been confirmed at the time of disclosure, a public proof of concept later became available, increasing the risk of rapid weaponization. Administrators were urged to verify that forced automatic updates succeeded and, if immediate patching was not possible, to apply mitigations such as blocking the REST batch endpoint with a WAF.
Jul 31, 2026
WordPress released **7.0.2** to fix two core vulnerabilities that can be chained into unauthenticated remote code execution, including **CVE-2026-63030** and **CVE-2026-60137**. The flaws affect default WordPress installations without plugins, with the RCE path impacting **6.9.0 through 6.9.4**, **7.0.0 through 7.0.1**, and **7.1 beta**, while the SQL injection issue also affects the **6.8** branch. WordPress issued backported fixes in **6.9.5**, **6.8.6**, and **7.1 Beta 2**, enabled forced auto-updates for affected sites, and said the attack chain abuses the REST API batch endpoint to trigger route confusion, bypass request handling restrictions, and reach SQL injection that can lead to full site compromise. Security vendors moved quickly to contain exposure as public technical details began to emerge. Cloudflare deployed WAF protections for both CVEs for all customers and Wordfence added firewall coverage for premium users, but both stressed that filtering is only a temporary mitigation and that patching is the primary remediation. Researchers attributed the discovery to Adam Kues of Searchlight Cyber's Assetnote team, and while early reporting said no in-the-wild exploitation had been confirmed, a public GitHub proof of concept later demonstrated unauthenticated access to the vulnerable batch endpoint and blind SQL injection against affected versions, increasing the likelihood of rapid attacker weaponization.
Aug 26, 2026
Two high-severity vulnerabilities have been disclosed in popular WordPress snippet-management plugins, exposing sites to **remote code execution** through `CWE-94` code injection flaws. `CVE-2026-25001` affects **Post Snippets** by Saad Iqbal in versions through `4.0.12`, while `CVE-2026-25366` affects **Woody ad snippets** (`insert-php`) by Themeisle in versions through `2.7.1`. Both issues were documented with Patchstack references and indicate that attackers could inject or include malicious code on vulnerable WordPress installations. The two CVEs differ in attack complexity but both carry severe impact to confidentiality, integrity, and availability. `CVE-2026-25001` is scored with `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H`, while `CVE-2026-25366` carries `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`, making the Woody ad snippets flaw easier to exploit once low privileges are obtained. Organizations running either plugin should identify affected versions, prioritize updates beyond the vulnerable releases, and review WordPress environments for signs of unauthorized code execution.
Jun 29, 2026