WordPress 7.1.1 Fixes a Flaw That Could Install a Theme on an Admin's Click
The maintenance release patches 11 security bugs, including a Click2Shell chain that abuses a logged-in administrator's browser session.
Key points
- WordPress 7.1.1, released on 17 September 2026, patches a flaw nicknamed Click2Shell that can silently install a theme when a logged-in administrator opens a crafted link.
- The maintenance release fixes 11 security bugs alongside 17 core bug fixes.
- One of the patched flaws is a stored cross-site scripting bug in the
wpautop()function, letting an unsigned-in visitor plant script through a comment. - Researchers at security firm pwn.ai reported the theme-install chain; WordPress recommends updating immediately.
- Sites with automatic updates enabled will pull the fix in on their own.
WordPress pushed out version 7.1.1 on 17 September 2026, a small maintenance release that closes a hole which could hand attackers a foothold on a site with almost no user interaction. It's the kind of patch that looks routine until you think about what it's actually stopping.
The headline bug, which the researchers who found it are calling Click2Shell, works like this. An administrator is logged in to their WordPress dashboard in one browser tab. They click a link somewhere else: an email, a message, a comment. That link talks to their own site in the background and tells it to install a theme, a design package, straight from the official WordPress.org directory. No install button gets pressed. The theme just lands.
On its own that's not a full break-in. The attacker still has to chain it to something else to run their own code. Themes are a well-known launchpad for exactly that next step, though, so the exposure is real.
What did WordPress actually fix?
The project shipped 11 security fixes in 7.1.1, plus 17 fixes in the core software.
One fix deserves a plain-English mention. A bug in a function called wpautop(), which tidies up paragraphs of text, let an unsigned-in visitor slip JavaScript into a comment. Once a moderator approved the comment, that script would run in other readers' browsers. It was reported by Rafie Muhammad of Awesome Motive. Another fix, in the HTML API, dealt with breaking out of an HTML comment using an odd closing sequence, reported by Jeremy Felt of the WordPress security team.
The Click2Shell chain was reported by pwn.ai. We've covered a busy stretch for WordPress security: on 26 August we reported the Critical Avada theme flaw that hands unauthenticated attackers full site control, and today we're also reporting a plugin flaw planting hidden backdoors on shop sites.
Who is affected and what should site owners do?
Anyone running a self-hosted WordPress site on a version before 7.1.1 is exposed. WordPress powers a large share of the public web, from local bakeries to national newspapers.
Automatic background updates will handle this for most sites, usually within a day. Turn it off, or run a managed host that pins versions, and you'll need to push the update by hand: Dashboard, Updates, Update Now.
| Item | Detail |
|---|---|
| Fixed version | WordPress 7.1.1 |
| Release date | 17 September 2026 |
| Security fixes | 11 |
| Core bug fixes | 17 |
| Next major release | 7.2, planned for December |
Should you worry if you only read WordPress sites?
Readers who don't run a site have nothing to act on. Admins do. The Click2Shell trick specifically punishes people who stay logged in while browsing, which is most of us.
Keep admin sessions out of the same browser profile you use for email and social media. Log out when you're done. Small habit, large difference in blast radius when something like this lands.
