WordPress Click2Shell Pre-Authentication RCE Advisory (QVD-2026-70986)
QiAnXin CERT reported WordPress Click2Shell (QVD-2026-70986), a high-severity pre-authentication remote code execution issue with a CVSS 3.1 score of 8.8. Fixed releases are WordPress 7.1.1, 7.0.5, and 6.9.8.
Advisory summary
QiAnXin CERT published a security advisory dated 18 September 2026 for a WordPress core pre-authentication remote code execution issue named Click2Shell and tracked as QVD-2026-70986. QiAnXin rates the vulnerability high. The CVSS 3.1 score is 8.8. The recorded threat type is code execution. QiAnXin assesses exploit likelihood as high. A proof of concept, an exploit, and technical details are public. In-the-wild exploitation has not been found. Estimated exposure is on the order of 100,000 installations.
An attacker who succeeds can run arbitrary PHP with the privileges of the web service account. That access can expose wp-config.php and database credentials, steal business data, create or change administrator users and content, alter application files, and take control of the WordPress site and its host.
Affected software
WordPress is an open-source content management system maintained by the WordPress Foundation. It is written in PHP and uses MySQL or MariaDB. Sites customize appearance with themes and extend function with plugins. WordPress underpins about 43 percent of websites worldwide, about 500 million sites, including corporate sites, news media, ecommerce, and blogs.
Issue description
QiAnXin CERT reported that the WordPress project issued a fix for Click2Shell (QVD-2026-70986). The issue is a pre-authentication remote code execution flaw in WordPress core that can lead to arbitrary PHP execution on the server. Official patches are available. Given the size of the affected population, QiAnXin advises operators to inventory WordPress versions and apply updates.
QiAnXin CERT stated that it confirmed the issue. A related screenshot is shown below.
Affected versions
The following version lines are affected:
- WordPress versions earlier than 7.1.1
- WordPress 7.0.x earlier than 7.0.5
- WordPress 6.9.x earlier than 6.9.8
Patches
The WordPress project has released security updates. Operators should move to a fixed release:
- WordPress 7.1.1 or later
- WordPress 7.0.5 or later
- WordPress 6.9.8 or later
Release packages are published at https://wordpress.org/download/releases/
Interim controls
Until patches are in place, QiAnXin recommends:
1. Audit and remove unused themes, including Mobile Repair Zone and third-party themes of unknown origin. 2. On a WAF or reverse proxy, block selector injection patterns in theme preview parameters. 3. Restrict WordPress administration access by source IP to reduce the chance that an administrator opens an untrusted page while logged in. 4. Enable WordPress logging and centralize audit. Watch for anomalous theme preview and customize requests, and for unexpected changes under theme and plugin directories.
References
1. https://pwn.ai/blog/click2shell 2. https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/ 3. https://wordpress.org/documentation/wordpress-version/version-7-1-1/