pwn.ai Discloses WordPress Core Flaw Allowing Forced Theme Install, Code Execution

En bref

• pwn.ai researchers reported a critical WordPress core flaw.
• Attackers can force a theme install from the WordPress.org directory, leading to code execution.
• Exploitation requires an administrator to open a specially crafted link.
• Patches were released today, September 2026; no CVE assigned yet.
• Admins should update immediately and audit themes.

Today, in September 2026, security analysts at pwn.ai disclosed a serious vulnerability in the core software that powers WordPress sites. The flaw permits an adversary to push a theme onto a target installation without proper authorization—a technique the researchers call Click2Shell. By luring a site administrator into clicking a specially crafted URL, the attacker can trigger the unauthorized theme installation and then escalate to running arbitrary code on the server. No CVE identifiers have been assigned to this issue so far.

Any site running an unpatched version of WordPress core is at risk, particularly those where administrators might click links from untrusted sources. The attack chain relies on the WordPress.org directory, which hosts themes that can be installed directly from the dashboard. Because the exploit requires an admin to open a malicious link, it is a form of social engineering combined with a technical flaw. The researchers note that the forced theme install bypasses normal permission checks.

This matters because WordPress powers a large share of the web, including many K-12 school district sites and education portals. A successful exploit gives an attacker the ability to execute code, potentially leading to data theft, website defacement, or use of the site as a pivot into other internal systems. The lack of a CVE means vulnerability scanners may not flag it yet, so manual patching is essential.

The pwn.ai team says it reported the flaw to WordPress maintainers, who released patches today. Site owners should apply the updates without delay. In the coming days, watch for proof-of-concept exploits or increased scanning activity targeting the vulnerable endpoint. Also monitor for unexpected theme changes or new administrative users. Because the attack hinges on an admin clicking a link, user awareness training can reduce risk.

À faire maintenant

1. Update WordPress core to the latest patched version immediately.
2. Audit all installed themes and remove any that are unused or unrecognized.
3. Instruct administrators to avoid clicking links from unknown senders; verify URLs before logging in.
4. Enable two-factor authentication for all admin accounts.
5. Deploy a web application firewall (WAF) rule to block requests that attempt unauthorized theme installation.
6. Monitor logs for unexpected theme changes, new admin users, or outbound connections.
7. Subscribe to WordPress security advisories for updates on CVE assignment.

Source originale

The Hacker News