---
id: 7620
title: "Click2Shell: Preauth WordPress Core Theme Preview Injection to RCE Chain"
source_domain: pwn.ai
source_url: "https://pwn.ai/blog/click2shell"
tags: ["ai-security", "rce", "wordpress", "vulnerability", "patch", "security-release", "preauth", "theme-injection"]
phying_url: "https://phying.com/item/7620"
lang: en
---

# Click2Shell: Preauth WordPress Core Theme Preview Injection to RCE Chain

## Summary

pwn.ai chained a pre-auth theme preview injection in WordPress Core with a flaw in the mobile-repair-zone catalog theme to achieve unauthenticated RCE via a single crafted link. Fixed in the WordPress 7.1.1 security release; CVE pending.

## Intelligence Metadata

- **Sources:** pwn.ai
- **Original:** https://pwn.ai/blog/click2shell
- **Phying News:** https://phying.com/item/7620