---
title: "New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution"
type: signal
url: https://frontiernewswire.com/s/new-wordpress-click2shell-flaw-forces-theme-installs-can-chain-to-code-cfe4fb0e
published: 2026-09-18T16:56:19.000Z
byline: "Source: The Hacker News"
---

# New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution

Source: The Hacker News · Published 2026-09-18 · Canonical: https://frontiernewswire.com/s/new-wordpress-click2shell-flaw-forces-theme-installs-can-chain-to-code-cfe4fb0e

WordPress today released patches to fix a new set of vulnerabilities in its core software, one of which could allow a crafted web link, opened by a logged-in administrator, to install a theme from the official WordPress.org directory without anyone clicking Install. The security firm pwn.ai, whose researchers reported the flaw, calls the attack chain Click2Shell. On its own the flaw only

In this story: [Pwn.ai](https://frontiernewswire.com/companies/pwn-ai)

## Sources

- [Read the original at The Hacker News](https://thehackernews.com/2026/09/new-wordpress-click2shell-flaw-forces.html)

## Related on Frontier

- [Researchers are paid $5K for reporting a bug to OpenAI that would let attackers run code in logged-in sessions of all who opened the hacker's ChatGPT share link (Swati Khandelwal/The Hacker News)](https://frontiernewswire.com/s/researchers-are-paid-5k-for-reporting-a-bug-to-openai-that-would-let-e77dabdc)
- [Critical Linux kernel flaw allows remote root attacks on MPTCP servers](https://frontiernewswire.com/s/critical-linux-kernel-flaw-allows-remote-root-attacks-on-mptcp-servers-fc74d8de)
- [Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor](https://frontiernewswire.com/s/official-claude-code-vs-code-extension-compromised-to-install-d53c08b0)
- [Anthropic AI model finds Linux kernel bug that leads to remote root access](https://frontiernewswire.com/s/anthropic-ai-model-finds-linux-kernel-bug-that-leads-to-remote-root-d428a906)
- [OpenClaw release-publish/a57e5beb1266-1793415069: fix(release): install WebKit for repo UI E2E (\#188985) is available](https://frontiernewswire.com/s/openclaw-release-publish-a57e5beb1266-1793415069-fix-release-install-d8b8b700)

---

[More Latest Signal](https://frontiernewswire.com/) · [Signals](https://frontiernewswire.com/verified-reporting)