WordPress wordpress core

WordPress Core <= 7.1 — Forced Theme Install/Preview and Selector Injection via Theme Installer Route

c34ef5e3-afcd-4686-861f-5e382812233aPublished Sep 17, 2026 · Updated Nov 13, 2026

Affected: ≤7.1Update to 6.6.8 or 6.7.8 or 6.8.9 or 6.9.8 or 7.0.5 or 7.1.1 or newer

Fixed versions are per release branch: update to the fix for the branch you run.

All remediation steps

Watch core

Medium4.3CVSS 3.14.3CISA KEVNot listedAccessNo account needed

On this page3

Overview

Advisory ID: c34ef5e3-afcd-4686-861f-5e382812233a
Product: WordPress wordpress
Affected: ≤7.1
Fixed in: 6.6.8, 6.7.8, 6.8.9, 6.9.8, 7.0.5, 7.1.1
Weakness: CWE-1021 Improper Restriction of Rendered UI Layers or Frames
Required access: No account needed
Published: Sep 17, 2026 · updated Nov 13, 2026
Credit: Paulos Yibelo

Affected≤ 7.1
Patched in6.6.8 / 6.7.8 / 6.8.9 / 6.9.8 / 7.0.5 / 7.1.1

4.3

CVSS 3.1 · CNA (Wordfence)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

What does this vector mean?

AV:N Attack vector: Network
AC:L Attack complexity: Low
PR:N Privileges required: None
UI:R User interaction: Required
S:U Scope: Unchanged
C:N Confidentiality: None
I:L Integrity: Low
A:N Availability: None

WordPress Core's theme installer (theme.js RunInstaller) passed the 'theme' slug from theme-install.php?theme=<slug> into a jQuery attribute selector ($('div[data-slug="'+slug+'"]')) without escaping, and matched any element rather than only theme cards. A crafted URL can automatically install and preview an inactive WordPress.org theme and inject an arbitrary jQuery selector.

Not sure which version you run? Run a passive check — it reads public files only.

Remediation & mitigations

Update to one of the following versions, or a newer patched version: 6.6.8, 6.7.8, 6.8.9, 6.9.8, 7.0.5, 7.1.1
Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.

References & provenance

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

Advisorywordfence.com

Timeline

Sep 17, 2026
CVE published
Severity medium, CVSS 4.3
Nov 13, 2026
Record last updated

Sources & licenses

Vulnerability data: Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Licensed under the CC BY-SA 4.0.
CVSS / CWE: National Vulnerability Database (NVD), shown unmodified. This product uses the NVD API but is not endorsed or certified by the NVD.

How we use these sources