This was a security-heavy week for WordPress. Two things most of you need to act on: update core to 7.1.1, and if you run The Events Calendar, get to 6.17.4.1+. Everything else today is awareness. Elementor opened an MCP beta that is worth a glance if you already live in Atomic Editor. WooCommerce shipped a quiet security dot release. I am keeping this as a Monday roundup, not a tutorial marathon.
WordPress 7.1.1 and Click2Shell: update core
WordPress 7.1.1 shipped on 2026-09-17 as a maintenance and security release. The official WordPress.org news post lists 17 Core bug fixes, 19 Block Editor fixes, and 11 security fixes. Because it is a security release, update from Dashboard → Updates (or WP-CLI / your host) and confirm the version string after.
One of those eleven fixes is the story people are calling Click2Shell. Researchers at pwn.ai reported it. Patchstack and The Hacker News both walked the public chain. Plain version: a crafted link that a logged-in admin opens can force-install a theme from the WordPress.org catalog. Alone, that lands an inactive catalog theme. Chained with a vulnerable theme (the public writeups used a demo theme with a bad AJAX installer), that path can reach remote code execution.
What it is not: an anonymous drive-by against every visitor. Authors and Editors cannot trigger it. Someone needs an admin session to load the crafted URL, or another XSS foothold that fires the request in an admin browser. Coverage I reviewed did not assign a CVE ID for Click2Shell yet, so I am not inventing one.
My take: the headlines sound louder than the trigger model. The RCE outcome is real when the full chain lands. The entry is still an admin click (or XSS). That is why I lead with “put 7.1.1 on,” not with midnight panic.
Do this for core:
- Update to WordPress 7.1.1 (or the matching backport on older eligible branches if you are stuck there). Latest WordPress is the actively supported line. Stay current when you can.
- Audit inactive themes. Remove unknown or leftover demo themes. Keep the active theme and one known-good default.
- Do not click weird theme-install or theme-preview URLs while logged into wp-admin. Email, Slack, random “try this theme” links: open logged out, or ignore.
Primary reads: WordPress 7.1.1 release, Patchstack on Click2Shell, The Hacker News, TechTimes 20 Sep.
Elementor MCP beta: AI that writes real Elementor structure
On 2026-09-15, Elementor opened an official MCP beta. Claude, Codex, Cursor, and other MCP-compatible tools can connect to a site and draft native Elementor / atomic structure, not a pile of mystery HTML.
What shipped, from Elementor’s own post: AI can build or edit atomic pages, work with design-system classes and variables, create theme parts (header, footer, archive, popup) with conditions, place components, and connect dynamic fields. Output saves as drafts you finish in the Editor. Access is admin-only and per site. You need the beta tester toggle, Atomic Editor on, and the new Elementor MCP page in the dashboard. With Angie installed, Elementor says the same bridge can reach broader WordPress abilities. Conflict detection kicks in if the Editor and the AI touch the same page at once.
Honestly, the only reason this drop matters to me is the “real Elementor structure” part. Clients still need something they can open in the Editor. If MCP dumped opaque code soup, I would skip it. Drafts of atomic structure are a different conversation.
Soft action only: if you are already on Atomic Editor, try MCP on a staging site. One page. One theme part. Review the draft like a junior builder’s first pass. If you are not on Atomic yet, bookmark the post and keep building. Nothing here forces a live-client experiment this Monday.
Source: Elementor MCP beta.
The Events Calendar: critical update if you run events
If The Events Calendar is on the site, update to 6.17.4.1 or newer.
Wordfence Argus found two independent critical unauthenticated chains (~600k+ installs). Shared path: single-event templates run do_blocks() over buffered HTML that includes comments, and pending-comment preview URLs let an unauthenticated commenter hit that path when comments are enabled on events (including TEC’s own “Show comments on event pages” option).
- CVE-2026-78006: PHP object injection → RCE. Patch ≥ 6.17.4.1.
- CVE-2026-78159: arbitrary callable path toward admin takeover. Fully patched line lands on the same “update to latest” target (6.17.4.1).
Both sit in CVSS 9.8 class in the advisories. Free Wordfence firewall rule for these issues lands for free users on 2026-09-21 (Premium had coverage earlier). A firewall rule is a seatbelt. It is not a substitute for updating the plugin.
My take: event plugins sit on a lot of “set and forget” church, conference, and venue sites. Those are the installs that miss security releases. If you maintain any of those for a client, check the version string today.
Actions: update TEC to ≥ 6.17.4.1. Disable event comments if you do not use them. Smoke-test one event page and the calendar view after.
Prefer primary citations via Patchstack (CVE-2026-78006), NVD CVE-2026-78159, and the Wordfence-attributed advisory republication (Wordfence.com was bot-walled during research).
Quick notes: Woo and one watch item
WooCommerce 11.1.1 shipped 2026-09-18. Security on REST API auth scoping, legacy options / mobile app login permissions, and guest-session validation, plus a Mini-Cart styling fix. No database update. Maintainer note: low-risk issues that require privileged admins. Still update if Woo is on the site. Quieter than Click2Shell. Still a security label. Source: WooCommerce 11.1.1.
Watch only (no action required this morning): Make/Core posted a 7.2 roadmap aimed at early December (Notes improvements, Secrets API, new default theme Ipsum). Useful background for Core watchers. Not a Monday fire drill.
Do this week
- Update WordPress core to 7.1.1. Confirm the version. Clear unknown inactive themes. Stay suspicious of theme-install links while logged into admin.
- If you run The Events Calendar, update to ≥ 6.17.4.1. Turn off event comments if unused. Let Wordfence (or your firewall) catch up, but do not wait on the firewall alone.
- If you run WooCommerce, update to 11.1.1. Low drama. Still do it.
- Elementor Atomic users: optional MCP try on staging only. Not a production day-one experiment.
- Fleet managers: batch the core and plugin updates the same way you would for any security Monday. Staging first when the stack is fragile. Same day when it is normal.
Soft close
That is the week: patch core for Click2Shell, patch TEC if you run events, glance at Elementor MCP if Atomic is already your path, and bump Woo while you are in Updates.
WPNXT lands Mondays in this same spot. If you want a second pair of eyes on whether your homepage and plugin stack are in a safe place after this week’s updates, you can reach out for a homepage review. No countdown. No score theater. Just a clear look at what is actually live.
Primary sources this week: WordPress 7.1.1 · Patchstack Click2Shell · The Hacker News Click2Shell · Elementor MCP beta · WooCommerce 11.1.1