Critical WordPress Theme‑Preview Bug Enables Remote Code Execution via Single Malicious Link

Security researchers have uncovered a new attack chain called Click2Shell that can turn a single crafted link into full remote code execution on WordPress sites that have not yet applied the latest patch.

The flaw resides in WordPress core's theme‑preview feature, which historically allowed administrators to view a theme before activation. A missing validation step lets an attacker inject a malicious payload that is later executed when the preview link is opened.

In practice, the attacker sends the victim a URL that appears innocuous. When an authorized user clicks the link, the vulnerable preview handler processes the request, writes a PHP shell to the server’s filesystem, and then runs it, granting the attacker the ability to execute arbitrary commands.

Because the exploit hinges on a single click, even sites that restrict file uploads or employ other hardening measures can be compromised if the preview endpoint is reachable. Successful exploitation could lead to data theft, site defacement, or the installation of additional malware.

WordPress maintainers have responded by releasing an emergency update that corrects the validation oversight. The project’s security team recommends that all installations, including those running older versions, apply the patch immediately and review any custom themes that might rely on the preview functionality.

WordPress powers an estimated 40 percent of all websites, making rapid adoption of security fixes crucial. Past incidents—such as the 2018 REST API exposure and the 2020 file‑inclusion bug—demonstrate how quickly a core vulnerability can be weaponized at scale.

Administrators are advised to not only update but also to audit server logs for unexpected preview requests, consider disabling the theme‑preview feature for non‑administrative users, and employ a web‑application firewall that can block the specific request pattern used by Click2Shell.

Researchers continue to monitor underground forums for signs of active exploitation. While no widespread attacks have been confirmed yet, the ease of the technique suggests that threat actors may begin targeting unpatched installations soon, underscoring the urgency of the recommended mitigations.