WordPress 7.1.1 was released on September 17, 2026 as a security and maintenance release. Along with 17 Core bug fixes and 19 Block Editor fixes, it includes 11 security fixes. One of the fixes addresses a vulnerability in which a specially crafted URL could cause an inactive theme from the WordPress.org directory to be installed and previewed when opened by a logged-in administrator.
Security researchers have referred to the issue as Click2Shell. The core issue is important for administrators because it shows why keeping WordPress updated is part of routine site maintenance, especially when an administrator may open links from email, messages, support tickets, or other untrusted sources.
What is the WordPress Click2Shell issue?
The vulnerability involves the way WordPress processes specially crafted URLs in the administration interface. According to the WordPress 7.1.1 security release notes, specially crafted URLs could automatically install and preview an inactive theme from WordPress.org.
The core issue does not mean that every visitor can remotely install an arbitrary theme on a WordPress site. The demonstrated scenario involves a logged-in administrator opening a maliciously crafted link. Security researchers also demonstrated that a separate vulnerable theme could potentially be used as part of a larger attack chain.
Why the 7.1.1 update matters
WordPress describes 7.1.1 as a security release and recommends updating sites immediately. The release includes 11 security fixes covering several areas of WordPress, not just the theme-installation issue.
WordPress also notes that the security fixes are being backported to supported older branches where necessary. However, the project states that only the most recent version is actively supported, making it preferable to run the latest available release when your site and hosting environment allow it.
What should WordPress site owners do?
- Check your WordPress version. Open Dashboard → Updates and confirm which version is installed.
- Update WordPress core. If your site is running an affected version, update to the latest release available for your branch. For the current 7.1 branch, that is WordPress 7.1.1.
- Back up before making changes. Keep a recent database and file backup, particularly for important business or WooCommerce sites.
- Check your themes and plugins. After the core update, review available updates and make sure your active theme and plugins are maintained.
- Test important site functions. Check the homepage, login, forms, checkout if applicable, the WordPress editor, and other workflows that are important to your site.
- Be careful with unexpected links. Administrators should avoid opening suspicious links while logged into WordPress. This is a useful security habit even after applying the patch.
What if you cannot update immediately?
Prioritize updating as soon as your maintenance process allows. Before updating a production site, you can create a backup and, for higher-risk sites, test the update on a staging copy first.
There is no reason to rely on an unverified workaround when the vendor has already released a security update. If you have a compatibility concern, test the update in staging and investigate any plugin or theme conflict rather than leaving the site permanently unpatched.
How to check whether your site updated successfully
After the update, return to Dashboard → Updates and confirm the installed version. Then test the site’s most important public and administrative functions.
If something breaks after the update, avoid immediately rolling back without understanding the cause. Check the plugin and theme updates, review available error information, and use a staging environment when possible. Our guide on testing a WordPress site after a major update provides a practical checklist.
Do you need to be worried if your site is already on 7.1.1?
If your site is already running WordPress 7.1.1, the Click2Shell issue fixed in that release is addressed in WordPress core. You should still keep your plugins and themes updated and follow normal administrator security practices.
Security updates are only one part of WordPress maintenance. Regular backups, limited administrator access, maintained plugins and themes, strong authentication, and monitoring can all reduce operational risk.
Bottom line
WordPress 7.1.1 is a security and maintenance release, not a feature release to postpone until later. If you manage a WordPress site, check your version and plan the update promptly. The Click2Shell issue is another reminder that administrator sessions are valuable targets and that security patches should be treated as routine maintenance.
Sources:
Leave a Reply to This Post