AIKIDO-2026-283478

johnpbloch/wordpress-core is vulnerable to Remote Code Execution (RCE)

Pre-CVE Published Sep 21, 2026

CVE Score

Critical

Remote Code Execution (RCE)

TL;DR

A URL-derived theme slug flows unescaped into a jQuery selector in WordPress Core's wp-admin/js/theme.js. A specially crafted theme-install.php?theme= URL closes the attribute selector and reaches the genuine Install control, so WordPress's own admin JavaScript automatically installs and previews an attacker-selected WordPress.org catalog theme after a logged-in administrator merely visits the link (no click on Install/Activate). Chained with a vulnerable installed-but-inactive theme loaded via the Customizer preview (for example mobile-repair-zone 2.5.4, among 40+ affected themes), an attacker achieves unauthenticated remote code execution as the WordPress server account ("Click2Shell"). Fixed in changeset 63664 by escaping the slug with $.escapeSelector and constraining the match to a div.theme card.

How do I fix this?

Upgrade the johnpbloch/wordpress-core library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and a logged-in administrator can be induced to visit an attacker-controlled link targeting theme-install.php. Reaching code execution additionally requires a separately vulnerable theme to be installable/present.

Package

johnpbloch/wordpress-core

Versions

4.7.0 - 4.7.35

Fixed in 4.7.36

4.8.0 - 4.8.30

Fixed in 4.8.31

4.9.0 - 4.9.31

Fixed in 4.9.32

5.0.0 - 5.0.27

Fixed in 5.0.28

5.1.0 - 5.1.24

Fixed in 5.1.25

5.2.0 - 5.2.26

Fixed in 5.2.27

5.3.0 - 5.3.23

Fixed in 5.3.24

5.4.0 - 5.4.21

Fixed in 5.4.22

5.5.0 - 5.5.20

Fixed in 5.5.21

5.6.0 - 5.6.19

Fixed in 5.6.20

5.7.0 - 5.7.17

Fixed in 5.7.18

5.8.0 - 5.8.15

Fixed in 5.8.16

5.9.0 - 5.9.16

Fixed in 5.9.17

6.0.0 - 6.0.14

Fixed in 6.0.15

6.1.0 - 6.1.12

Fixed in 6.1.13

6.2.0 - 6.2.11

Fixed in 6.2.12

6.3.0 - 6.3.10

Fixed in 6.3.11

6.4.0 - 6.4.10

Fixed in 6.4.11

6.5.0 - 6.5.10

Fixed in 6.5.11

6.6.0 - 6.6.7

Fixed in 6.6.8

6.7.0 - 6.7.7

Fixed in 6.7.8

6.8.0 - 6.8.8

Fixed in 6.8.9

6.9.0 - 6.9.7

Fixed in 6.9.8

7.0.0 - 7.0.4

Fixed in 7.0.5

7.1.0 - 7.1.0

Fixed in 7.1.1

Background info

johnpbloch/wordpress-core is vulnerable to Remote Code Execution (RCE) in versions 7.1.0 - 7.1.0, 7.0.0 - 7.0.4, 6.9.0 - 6.9.7, 6.8.0 - 6.8.8, 6.7.0 - 6.7.7, 6.6.0 - 6.6.7, 6.5.0 - 6.5.10, 6.4.0 - 6.4.10, 6.3.0 - 6.3.10, 6.2.0 - 6.2.11, 6.1.0 - 6.1.12, 6.0.0 - 6.0.14, 5.9.0 - 5.9.16, 5.8.0 - 5.8.15, 5.7.0 - 5.7.17, 5.6.0 - 5.6.19, 5.5.0 - 5.5.20, 5.4.0 - 5.4.21, 5.3.0 - 5.3.23, 5.2.0 - 5.2.26, 5.1.0 - 5.1.24, 5.0.0 - 5.0.27, 4.9.0 - 4.9.31, 4.8.0 - 4.8.30 and 4.7.0 - 4.7.35.

CVE Score

Critical

Remote Code Execution (RCE)

Are you affected? Scan for Free