Preliminary research

Click2Shell: theme-selector injection and preactivation code execution in WordPress

Click2Shell: Preauth WordPress Core Theme Preview Injection to RCE Chain

PWNAI Research · pwn.ai · 18 September 2026

AI-collected research leads through 24 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.

A theme slug is normalized by the catalog API but reused as selector syntax in WordPress admin JavaScript, forcing installation. Customizer loading of an inactive vulnerable catalog theme then exposes an unchecked plugin installer, enabling PHP execution after an administrator follows the crafted link.

Record

Document

Click2Shell: Preauth WordPress Core Theme Preview Injection to RCE Chain

Researcher

PWNAI Research

Published by

pwn.ai

Date

18 September 2026

Topic

Injection

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Click2Shell: The RCE WordPress 7.1.1 Just Patched
• Demonstration

Tags

• wordpress
• csrf
• css-injection
• dom
• parser-differential
• rce
• attack-chain
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of PWNAI Research, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 24 September 2026.