You may have seen a headline saying a WordPress flaw lets attackers install themes and run code on your server. Or someone may have told you your site showed visitors a fake "verify you are human" screen that tried to get them to install malware. Either way, the worry underneath is the same: did your site hurt the people who trust it, and can you tell quickly? The Click2Shell WordPress flaw is real, and it was fixed on September 17 in WordPress 7.1.1. It is not the same thing as the fake verification screen, which came from a separate incident at an email and forms company called Brevo. A second WordPress flaw, Comment2Shell, was fixed in the same update. Each of the three has its own conditions, and some sites may be touched by none of them. You can sort out which ones could apply to your site in a few minutes, and you should know what to do next by the time you finish reading.
Key Takeaways
WordPress 7.1.1, released September 17, 2026, fixes both Click2Shell and Comment2Shell, and older branches got security builds such as 7.0.5 and 6.9.8.
The attack starts when an administrator who can install themes opens a crafted link, and running code on the server also needs a separate vulnerable theme.
For 5 hours 29 minutes on September 14, Brevo's hosted forms, chat widget and SDK loader served a fake Cloudflare check, and on WordPress it tried to install a plugin only when a logged-in administrator visited.
Patching closes the hole, but a plugin, file or account added before the patch stays until someone finds and removes it.
Which of the three problems could affect your site, and what should you do first?
Click2Shell and Comment2Shell are separate WordPress Core flaws fixed in the September 17, 2026 security release. Update WordPress now, to the newest release rather than stopping at 7.1.1, because the WordPress 7.1.2 security update fixed a second critical flaw five days later. Then check for any theme or plugin you do not recognize. Separately, if your site used Brevo forms, Brevo Conversations or Brevo's SDK loader, and an administrator visited the site while logged in on September 14, review the plugins installed that day and change your administrator passwords.
That is the whole first answer. WordPress itself puts it bluntly in its 7.1.1 security release notes: "Because this is a security release, it is recommended that you update your sites immediately." If your site updates itself automatically, it may already be on the fixed version, but confirm it rather than assume it.
What none of these three problems means is that every WordPress site is compromised. Both Core flaws need a specific chain of events, and the Brevo incident needed a specific script to be on your site during a specific window. The sections below explain each one so you can see which conditions your site meets.
What is Click2Shell in WordPress?
Click2Shell is a flaw in WordPress Core, the software every WordPress site runs, not in a plugin or theme. It was found by Paulos Yibelo and the security firm pwn.ai, who published their Click2Shell technical write-up on September 18, the day after WordPress shipped the fix.
The attack works through a crafted link. If an administrator who is allowed to install themes opens that link while logged in, WordPress can be pushed into installing and previewing a theme from the official WordPress.org catalog without the administrator ever clicking Install. The technique abuses the theme preview flow. pwn.ai describes it as a cross-site request forgery that leads to selector injection, which in everyday terms means the attacker's link makes your own logged-in browser do the work.
Installing a catalog theme is not the same as running the attacker's code. To reach that point, pwn.ai paired the flaw with a separate theme that had its own weakness, Mobile Repair Zone version 2.5.4, and showed PHP code running on the server. So, the dangerous version of Click2Shell needs three things: an unpatched site, an administrator who opens the link while signed in, and a vulnerable theme the attacker can pull in.
pwn.ai says WordPress versions before 7.1.1 are affected. Its public disclosure did not carry a CVE number, and WordPress's release notes credit the report as a crafted-URL problem in theme install and preview. Belgium's Centre for Cybersecurity (CCB) published a warning on September 23 naming Click2Shell and Comment2Shell and saying both can lead to remote code execution, and Thailand's ThaiCERT posted its own Click2Shell alert the same day. No source reviewed for this post shows attackers actively using Click2Shell against real sites so far.
What is Comment2Shell, and does it affect my comments?
Comment2Shell is a second, separate Core flaw fixed in the same release. It has a formal record, CVE-2026-93485, and it was reported by Rafie Muhammad. It is a stored cross-site scripting flaw in wpautop, the part of WordPress that turns plain line breaks in text into paragraphs.
In practice, someone with no account submits a comment with crafted content hidden inside. If that comment gets published, through your approval or through a setting that publishes comments automatically, the hidden script is stored on your site. The serious version of the attack needs an administrator to view that comment while logged in, so the script runs with the administrator's access. The Patchstack entry for this flaw tracks it as a WordPress 7.1 cross-site scripting issue, and the CVE carries a severity score of 7.1 out of 10.
Fixed builds include 7.1.1, 7.0.5 and 6.9.8, with security backports going as far back as the 4.7 branch in version 4.7.36. If you cannot move to 7.1 yet, the latest build on your own branch still closes this hole. Comment moderation lowers your exposure while you update, but it is not a substitute for the patch.
| Click2Shell | Comment2Shell | Brevo ClickFix incident | |
|---|---|---|---|
| What it is | WordPress Core flaw in theme preview | WordPress Core flaw in wpautop | Third-party script tampering at Brevo's network edge |
| Record | No CVE in pwn.ai's disclosure | CVE-2026-93485, score 7.1 | Brevo incident write-up |
| How it starts | Administrator opens a crafted link while logged in | Anyone submits a crafted comment | Visitor loads a page with an affected Brevo script |
| What it needs to do real harm | A separate vulnerable theme | The comment published, then viewed by a logged-in administrator | A logged-in WordPress administrator visiting during the window |
| Date | Fixed September 17, disclosed September 18 | Fixed September 17 | September 14, 15:01 to 20:30 UTC |
| Your fix | Update to 7.1.1 or later | Update to 7.1.1 or your branch's security build | Review plugins from that day, change admin passwords |
How do you confirm your WordPress version is patched?
Log in to your dashboard by typing your site's usual address, not by clicking a link in an email. Go to Dashboard, then Updates. The page shows which version you run and offers any newer release. If it offers an update, take a backup of your files and database first, update, then test the pages that matter most: your contact form, your booking or checkout flow and your home page.
Treat the update as closing a door, not as cleaning the house. If someone got in before you patched, anything they added stays behind: a plugin, a new administrator account, a PHP file tucked into a folder. That is why the checks later in this post still matter after you update. If a separate plugin warning has also landed in your inbox, our post on what to do when you get a WordPress plugin vulnerability warning walks through that order of steps.
Why did my website show a fake Cloudflare "verify you are human" prompt?
If visitors reported a Cloudflare-style check that asked them to press keys and paste something, the likely source is not Click2Shell. It is a separate supply-chain incident at Brevo, a company whose forms, chat widget and scripts load on other businesses' websites. The three parts below cover what Brevo says happened, what visitors saw, and what the script tried to do on WordPress sites. Every detail here comes from Brevo's own account, apart from one outside estimate that is labeled as such.
What happened at Brevo on September 14
According to Brevo's incident write-up, an attacker used a compromised Cloudflare API key to deploy a Worker, a small program that runs at the edge of Cloudflare's network, and used it to rewrite what Brevo's hosted assets sent to browsers. It ran for 5 hours 29 minutes, from 15:01 to 20:30 UTC on September 14. The affected pieces were Brevo's own pages, sibforms.com, the Brevo forms script, the Brevo Conversations chat widget and the SDK loader.
Brevo says its source systems, app.brevo.com, its API, its email sending and customer account data were not affected. This was not a hacked WordPress plugin. It was tampering with scripts that websites load from Brevo.
What visitors saw
The altered script sometimes showed a full-screen page dressed up as a Cloudflare verification check, sometimes after a genuine checkbox. Brevo says it told Windows users to press Win+R, then Ctrl+V, then Enter. That sequence opens the Run box and pastes a command the page had already copied to the clipboard, which then downloaded malware. This trick is known as ClickFix.
A real CAPTCHA never asks you to open Run and paste anything. The prompt was also selective, so loading your site today and seeing nothing does not prove it never appeared to anyone on September 14.
What it tried to do on WordPress sites
On WordPress sites with an affected Brevo script embedded, the altered code tried to install and activate a plugin silently, but only when the visitor was a logged-in WordPress administrator. An ordinary visitor could not trigger that part. The security firm Sansec reported the script reached more than 100,000 customer sites. That is Sansec's estimate, not a figure Brevo publishes, and it is not a count of WordPress sites that ended up with a plugin installed.
Did the Brevo incident reach your WordPress site?
Start with one question: did your site load a Brevo form, the Brevo Conversations widget or Brevo's SDK loader on September 14? If it did not, this incident does not apply to your site. If it did, the next question is whether anyone with an administrator login visited the public site while signed in between 15:01 and 20:30 UTC that day. Convert that window to your own time zone before you ask your team.
If the answer is yes, or you cannot tell, follow Brevo's own steps. Go to Plugins and look for anything installed or activated on September 14. Remove any plugin you do not recognize, and change every administrator password. Before you delete anything, take screenshots and note file names and timestamps, because that record is what a security specialist will want if the problem turns out to be bigger than one plugin.
Loading an affected Brevo script does not by itself prove your site was backdoored. The strongest sign is the combination: the script was present and a logged-in administrator visited during the window.
If a visitor, customer or staff member actually followed the prompt and ran the command, the website is only part of the job. Brevo says that computer should be disconnected from the network, scanned, and every password used on it changed.
What can you check in ten minutes?
These checks cover all three problems at once. Do them in order, and stop to get help if any step turns up something you cannot explain.
The ten-minute check for Click2Shell, Comment2Shell and Brevo
- 1
Minutes 1 to 2, Core version
Open Dashboard, then Updates. Confirm you are on 7.1.1 or later, or your branch's latest security build, and update if you are not.
- 2
Minutes 3 to 4, themes and plugins
Look through Appearance, Themes and the Plugins list for anything unknown, newly installed or unexpectedly active. Check Users for any administrator you did not create.
- 3
Minutes 5 to 6, the Brevo window
If your site uses Brevo forms, Conversations or the SDK loader, ask whether an administrator visited while logged in on September 14, 15:01 to 20:30 UTC.
- 4
Minutes 7 to 8, the public site
Open your pages in a private browser window. If anything asks you to press Win+R or paste a command, stop and do not follow it.
- 5
Minutes 9 to 10, recent files
In your host's file manager or change log, look for unfamiliar recent PHP files in wp-content/plugins, wp-content/mu-plugins and your themes folder. Screenshot anything odd and keep the timestamps.
Two cautions apply the whole way through. Do not paste commands from anywhere into your computer, and do not open links that claim to test your site for these flaws. Those are exactly the tools these attacks use.
When does this need professional help?
Some findings mean the job is bigger than an update. Get qualified help promptly if you find an unknown plugin, a new administrator account, a PHP file nobody can explain, evidence that an administrator was logged in on your site during Brevo's window, or a report that someone ran the ClickFix command. At that point you are dealing with a possible break-in, not a missing patch, and removing one visible file can leave the rest in place. Keep the logs and timestamps before anything is rebuilt, and if you need the first steps in order, our guide to the first 24 hours after a website is hacked covers them.
The other side matters just as much. If your site is updated, it never loaded the affected Brevo scripts, and nothing unknown turned up in your users, plugins or files, an emergency cleanup is probably not justified. Routine maintenance may be all you need. If Brevo scripts were present but there is no sign an administrator visited while logged in, a focused review makes more sense than assuming the worst.
No scan or vendor can promise a site was never exposed or will stay safe. What a proper review gives you is a written record of what was checked, what was found and what changed.
How do you keep the next one from reaching your site?
The same habits cut the risk from all three problems, and none of them needs special software. WordPress's own hardening guide calls security "risk reduction, not risk elimination," and recommends updates, removing what you do not use, tight file permissions, logs, monitoring and a web application firewall.
- Update Core, themes and plugins promptly: Security releases like 7.1.1 close holes that have already been made public.
- Delete what you do not use: Remove unused plugins rather than just deactivating them, and remove unused themes while keeping one default theme as a fallback. Click2Shell showed that a theme can matter before it is ever activated.
- Keep administrator accounts few: Give administrator access only to people who need it, and limit who can install themes and plugins.
- Use unique passwords and multi-factor sign-in: A stolen password is far less useful when a second step is required.
- Do not open unexpected links while logged in: Both Core flaws turn an administrator's own browser into the tool, so sign out before clicking links from strangers.
- Turn off comments where they do nothing for you: Where you keep them, require moderation, especially while an update is pending.
- Keep a list of third-party scripts: Know which outside services load code on your pages, and follow their incident notices.
A firewall helps as one layer, but it is not proof of safety here. These attacks run through an administrator's signed-in browser and normal WordPress actions, which can look like ordinary use.
Which WordPress problem are you dealing with?
Pick an answer to begin.
1. Your site is on WordPress 7.1.1. Does that remove a plugin an attacker added before you updated?
2. What does Click2Shell need before it can do serious harm?
3. A page asks you to press Win+R, then Ctrl+V, then Enter to prove you are human. What is it?
Frequently Asked Questions About click2shell wordpress
Is Click2Shell a plugin vulnerability?
No. Click2Shell is a flaw in WordPress Core, in the theme preview and install flow. The demonstrated path to running code on the server also needed a separate vulnerable theme.
Does Click2Shell have a CVE number?
Not in pwn.ai's public disclosure. CVE-2026-93485 belongs to Comment2Shell, so do not use it for Click2Shell.
What is Comment2Shell?
It is CVE-2026-93485, a stored cross-site scripting flaw in WordPress's wpautop formatter. Anyone can submit the crafted comment, but the serious chain needs a logged-in administrator to view it once published.
Which WordPress versions fix Click2Shell and Comment2Shell?
WordPress 7.1.1, released September 17, 2026, fixes both. Security builds for older branches include 7.0.5 and 6.9.8, with backports as far back as 4.7.36.
Was the Brevo ClickFix attack a WordPress plugin compromise?
No. Brevo says a compromised Cloudflare API key let an attacker alter its hosted scripts at the network edge on September 14. On WordPress sites that loaded those scripts, it tried to install a plugin only when a logged-in administrator visited.
Does updating WordPress remove malware?
No. Updating closes the vulnerable path, but a plugin, file or account added before the update stays until someone finds and removes it.
Final Thoughts
Click2Shell and Comment2Shell are two different WordPress Core flaws, both fixed in 7.1.1 on September 17, and both need a logged-in administrator somewhere in the chain before they do serious harm. The fake Cloudflare prompt is a third problem, Brevo's September 14 script tampering, and it only matters if your site loaded an affected Brevo script during that window. Update first, then check your users, plugins, themes and recent files. If nothing unknown turns up, routine upkeep may be all your site needs.
Once you know your version, your administrators and the outside scripts on your pages, the next alert becomes a quick check instead of a scramble. That record also tells you, and anyone you hire, exactly where to look if something ever does go wrong.
If your checks turned up something you cannot explain, or you would rather not do them alone, Web Leveling can help. Our website security audit reviews your users, plugins, themes, files and third-party scripts, then gives you a written report of what we found and what to fix, and it will say so if routine maintenance is all you need. We work with small and medium businesses across the country and overseas. Tell us what you are seeing on your WordPress site, and we will help you work out what it means and what to do next.
Terms
WordPress security words in this post
Tap a term to see what it means.
WordPress Core. The main WordPress software that every WordPress site runs, separate from the plugins and themes added to it.
CVE. A public identifier for one specific security flaw, such as CVE-2026-93485 for Comment2Shell.
Cross-site scripting (XSS). A flaw that lets an attacker slip script into a page so it runs in another person's browser.
Cross-site request forgery (CSRF). A trick that makes a logged-in person's browser send a request they never meant to make.
ClickFix. A fake verification screen that tells visitors to paste and run a command, which installs malware.
Supply-chain attack. An attack on a service other websites rely on, so the harm reaches those sites through code they trust.
Must-use plugin. A plugin placed in the wp-content/mu-plugins folder, which WordPress loads automatically on every page.
