Preliminary research

Click2Shell: theme-selector injection and preactivation code execution in WordPress

PWNAI Research · 18 September 2026

AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

A theme slug is normalized by the catalog API but reused as selector syntax in WordPress admin JavaScript, forcing installation. Customizer loading of an inactive vulnerable catalog theme then exposes an unchecked plugin installer, enabling PHP execution after an administrator follows the crafted link.

Record

Researcher

PWNAI Research

Date

18 September 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Technical explanation
• Demonstration

Tags

• wordpress
• csrf
• css-injection
• dom
• parser-differential
• rce
• attack-chain
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of PWNAI Research, first published at the original source. Preserved copies are kept so the citation survives its host.