Back Sploitus

click2shell

Sploitus • September 19, 2026

Share: View original

Python proof-of-concept scripts for **Click2Shell**, the WordPress pre-authentication

remote-code-execution chain publicly disclosed by the **pwn.ai research team**

([pwn.ai/blog/click2shell]( disclosed September 18, 2026).

> ⚠️ **Lab use only.** Test exclusively against isolated WordPress installations you

> own or are explicitly authorized to test. The Core issue is **patched in WordPress

> 7.1.1** (released September 17, 2026) — verify your lab target runs a vulnerable

- Patch: WordPress 7.1.1 (September 17, 2026)

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Click2Shell Exploit Targets WordPress Pre-Authentication Flaw The Click2Shell exploit, a pre-authentication remote code execution vulnerability in WordPress, was publicly disclosed by the pwn.ai research team on September 18, 2026. This vulnerability affects WordPress installations prior to version 7.1.1, which was released on September 17, 2026, to address the issue. The exploit allows attackers to execute arbitrary code without authentication, posing a significant risk to affected systems. Users are urged to verify their installations and apply the patch if they are running vulnerable versions. The proof-of-concept scripts for the exploit have been made available for lab testing only, emphasizing the need for responsible use. Organizations should ensure that their WordPress installations are updated to mitigate this risk. The scope of impact could be widespread given the popularity of WordPress as a content management system. 2 sources 58

Extracted Entities

Attack Types (1)

Zero-day Exploit

MITRE ATT&CK (1)

T1190 - Exploit Public-Facing Application

Platforms (1)

Vulnerabilities (1)