20 September 2026
1. What is being reported?
Researchers have found a weakness in WordPress that lets attackers trick the system into installing themes without permission. This flaw can be combined with other weaknesses to execute harmful commands on the website, which could let hackers control the site or steal information.
2. What this means in plain English
If your organisation uses WordPress for its website, this vulnerability could let criminals take over your site, change its content, or access sensitive data. This could harm your reputation, disrupt your business, or lead to data loss.
3. Could this affect a small business?
Small businesses and charities using WordPress websites could be affected, especially if they use themes that are not regularly updated or do not have security measures in place. Organisations not using WordPress or those with professionally managed websites are less likely to be impacted.
4. What to do now
- Check if your WordPress website and themes are up to date with the latest security patches.
- Contact your website manager or IT provider to confirm if your site is protected against this vulnerability.
- Avoid installing themes or plugins from untrusted sources.
- Regularly back up your website data to recover quickly if needed.
5. Ask your IT provider
Can you confirm if our WordPress website is protected against the recent Click2Shell vulnerability that allows forced theme installation and potential code execution?
6. Bottom line
Keep your WordPress site and themes updated and ask your IT support about this new vulnerability to keep your website safe.
Information based on reputable security reporting and CISA KEV.