AIKIDO-2026-278073

roots/wordpress is vulnerable to Remote Code Execution (RCE)

Pre-CVE Published Sep 21, 2026

CVE Score

Critical

Remote Code Execution (RCE)

TL;DR

A URL-derived theme slug flows unescaped into a jQuery selector in WordPress Core's wp-admin/js/theme.js. A specially crafted theme-install.php?theme= URL closes the attribute selector and reaches the genuine Install control, so WordPress's own admin JavaScript automatically installs and previews an attacker-selected WordPress.org catalog theme after a logged-in administrator merely visits the link (no click on Install/Activate). Chained with a vulnerable installed-but-inactive theme loaded via the Customizer preview (for example mobile-repair-zone 2.5.4, among 40+ affected themes), an attacker achieves unauthenticated remote code execution as the WordPress server account ("Click2Shell"). Fixed in changeset 63664 by escaping the slug with $.escapeSelector and constraining the match to a div.theme card.

How do I fix this?

Upgrade the roots/wordpress library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and a logged-in administrator can be induced to visit an attacker-controlled link targeting theme-install.php. Reaching code execution additionally requires a separately vulnerable theme to be installable/present.

Package

roots/wordpress

Versions

0.0.1 - 5.4.21

Fixed in 5.4.22

5.5 - 5.5.20

Fixed in 5.5.21

5.6 - 5.6.19

Fixed in 5.6.20

5.7 - 5.7.17

Fixed in 5.7.18

5.8 - 5.8.15

Fixed in 5.8.16

5.9 - 5.9.16

Fixed in 5.9.17

6.0 - 6.0.14

Fixed in 6.0.15

6.1 - 6.1.12

Fixed in 6.1.13

6.2 - 6.2.11

Fixed in 6.2.12

6.3 - 6.3.10

Fixed in 6.3.11

6.4 - 6.4.10

Fixed in 6.4.11

6.5 - 6.5.10

Fixed in 6.5.11

6.6 - 6.6.7

Fixed in 6.6.8

6.7 - 6.7.7

Fixed in 6.7.8

6.8 - 6.8.8

Fixed in 6.8.9

6.9 - 6.9.7

Fixed in 6.9.8

7.0 - 7.0.4

Fixed in 7.0.5

7.1 - 7.1

Fixed in 7.1.1

Background info

roots/wordpress is vulnerable to Remote Code Execution (RCE) in versions 7.1 - 7.1, 7.0 - 7.0.4, 6.9 - 6.9.7, 6.8 - 6.8.8, 6.7 - 6.7.7, 6.6 - 6.6.7, 6.5 - 6.5.10, 6.4 - 6.4.10, 6.3 - 6.3.10, 6.2 - 6.2.11, 6.1 - 6.1.12, 6.0 - 6.0.14, 5.9 - 5.9.16, 5.8 - 5.8.15, 5.7 - 5.7.17, 5.6 - 5.6.19, 5.5 - 5.5.20 and 0.0.1 - 5.4.21.

CVE Score

Critical

Remote Code Execution (RCE)

Are you affected? Scan for Free