Skip to content
Kaagazo.
Trendingsecurityseo

WordPress 7.1.1 is a security release — update today, then run this 10-minute hardening checklist

The 17 September release fixes 11 flaws including 'Click2Shell', where a single link opened by a logged-in admin silently installs a theme and can chain to full server takeover. If your shop, clinic or agency runs on WordPress, here is what to do this week — and how to spot the ClickFix scams doing the rounds.

Published 20 September 2026 · 4 min read · Kaagazo editorial

WordPress 7.1.1 is a security release — update today, then run this 10-minute hardening checklist — illustration

Most Indian small-business websites run WordPress, and most of them are managed by whoever built them two years ago. That combination is why security researchers' disclosures turn into real breaches months later. WordPress 7.1.1, released on 17 September 2026, closes eleven vulnerabilities, and one of them — nicknamed Click2Shell by the researchers at pwn.ai — deserves your attention today.

What Click2Shell does

  • An attacker crafts a web link. If a logged-in WordPress administrator opens it, WordPress's own scripts install a theme from the official WordPress.org directory — no Install button clicked, no prompt.
  • The theme stays inactive, so the site looks unchanged.
  • On its own that is annoying but not fatal (severity 7.1). Chained with a vulnerable theme — the researchers used one with an unauthenticated download-and-run handler — it becomes remote code execution (severity 9.6): the attacker's code runs on your server, with your database, customer data and payment integrations.
  • Affected: WordPress 6.0 through 7.1.0. Fixed in 7.1.1 and in back-ported updates to older branches down to 4.7.
  • No exploitation in the wild has been reported yet. That usually changes within weeks of a public write-up.

The other ten fixes include stored cross-site scripting and path traversal issues — the routine kind that get used in automated attacks on unpatched sites.

Do this today (10 minutes)

  1. Update WordPress core to 7.1.1: Dashboard → Updates. If auto-updates are on, confirm the version in the footer of the dashboard.
  2. Update every plugin and theme while you're there. Delete inactive themes and plugins — they are still attack surface. Check Appearance → Themes for anything you don't recognise; Click2Shell leaves an inactive theme behind.
  3. Change the admin password if it is shared, old, or reused anywhere. Generate a proper one with the password generator; check any existing one with the strength checker.
  4. Enable two-factor authentication for every administrator account (Wordfence, Solid Security or the WordPress.com 2FA plugin).
  5. Remove unused admin accounts — the developer who left, the "test" user, the agency login from 2023.

Do this week (30 minutes)

  • Turn on automatic minor/security updates for core, and auto-updates for plugins you trust.
  • Install a security plugin with a firewall and login rate-limiting; free tiers are enough for a brochure site.
  • Back up to somewhere outside the hosting account (UpdraftPlus to Google Drive is the common choice) and test a restore once.
  • Don't browse while logged in as admin. Click2Shell needs an admin's browser session. Use a separate browser profile for WordPress admin, log out when done, and never open links from unknown emails in that profile.
  • Check robots.txt and meta tags haven't been tampered with (spam SEO injections often change them) — the robots.txt generator and meta tag generator give you clean versions to compare against.
  • Review file permissions and disable the theme/plugin file editor (DISALLOW_FILE_EDIT in wp-config.php).

Also this week: the "ClickFix" scam

Security firms report a wave of ClickFix attacks — including via a hijacked HBO Max account on Reddit — where a fake error page ("Your browser needs a fix — press Win+R and paste this") tricks the user into running malware themselves. Staff who search for "Windows error fix" or click ads are the target. The rule: never paste a command someone on the internet tells you to paste. No legitimate site asks you to run commands to view content.

If you think you've been hit

  • Symptoms: unknown admin users, new inactive themes/plugins, spam pages in Google results, redirects on mobile, hosting warnings.
  • Take the site offline or into maintenance mode, restore from a clean backup, rotate all passwords and API keys (payment gateway, email, hosting), update everything, then bring it back.
  • Under the DPDP Rules, a breach involving customer personal data must be reported to affected users and the Data Protection Board — keep that in mind if your site stores orders.

FAQ

My site is on Shopify / Wix / Dukaan. Does this affect me?

No — Click2Shell is a WordPress core flaw. Hosted platforms patch themselves. Still enable 2FA on your account.

My hosting provider manages WordPress. Do I still need to act?

Managed hosts usually push core updates within days; verify the version is 7.1.1 and confirm plugins are updated too — hosts often leave plugins to you.

Is it safe to update plugins along with core?

Yes; take a backup first. If a plugin breaks the site after update, roll back that plugin, not the core security update.

How do I know which WordPress version I'm on?

Dashboard → At a Glance shows it, as does the footer of any admin page.

Keep reading