WordPress has released a security update fixing several vulnerabilities in its core software, including a high-severity flaw that could allow attackers to force a logged-in administrator to install a theme from the official WordPress.org directory simply by opening a specially crafted link.
Security firm pwn.ai, whose researchers discovered the vulnerability, has dubbed the attack chain Click2Shell. The core flaw by itself can only force WordPress to install a legitimate theme selected by the attacker, but researchers demonstrated that it could be combined with another vulnerability in the installed theme to execute the attacker’s own code on the server.
WordPress addressed the issue on September 17 with version 7.1.1 and recommends that site owners install the security update as soon as possible. There is currently no evidence that the vulnerability has been exploited in real-world attacks.
One reason the attack can be difficult to notice is that the newly installed theme remains inactive. As a result, the website’s appearance does not change and there may be no obvious sign that anything has happened. Turning the core flaw into a full server compromise also requires a separate vulnerability in the theme that gets installed.
The attack works because WordPress and the WordPress.org theme directory interpret the same URL differently. The directory processes part of the link as a normal theme name and returns an actual theme, while the administrator’s browser retains the attacker-controlled characters and uses them to identify an element on the page. By carefully manipulating the URL, an attacker can cause WordPress’s own JavaScript code to locate the Install button and trigger it automatically.
Since the victim is already logged in as an administrator, the browser automatically provides the authentication session and security token required for the installation. The attacker therefore does not need to obtain those credentials or tokens separately.
An inactive theme can also become relevant because WordPress may load a theme’s PHP code when generating a preview through the Customizer, even if the theme has not been activated on the website.
For its demonstration, pwn.ai used a theme called Mobile Repair Zone, which contained a separate security flaw. The theme included a background handler capable of taking a web address from a request, downloading a package and executing its code without properly checking the visitor’s permissions or requiring a security token. When combined with the forced theme installation, the researchers were able to use that weakness to execute their own code on the server.
The Click2Shell core vulnerability was rated high severity by the researchers, with a CVSS score of 7.1. When combined with the separate theme vulnerability, the complete attack chain reached a critical CVSS score of 9.6. WordPress has not assigned its own severity rating and described the core issue more narrowly in its security release, noting that specially crafted URLs could automatically install and preview an inactive theme from WordPress.org.
The vulnerability does not currently have a CVE identifier, although pwn.ai said WordPress plans to assign one.
The security fix is included in WordPress 7.1.1 and has also been backported to supported branches as far back as version 4.7. According to WordPress’s documentation, the affected behavior was present from version 6.0 through the releases immediately before the fix. Website owners should update to 7.1.1 or install the corresponding security update for the WordPress branch they use. Websites with automatic updates enabled should receive the fix automatically.
Neither WordPress nor pwn.ai has provided a separate workaround for sites that cannot update immediately. The attack also requires a logged-in administrator to open a maliciously crafted link. Updating WordPress core remains the direct way to prevent the demonstrated Click2Shell attack regardless of which theme a website uses.
Click2Shell is the latest in a series of WordPress core security issues investigated by pwn.ai. In August, the company disclosed another WordPress vulnerability involving the login screen that could also be chained to achieve code execution. WordPress again described the underlying core issue more narrowly than the researchers’ demonstrated attack chain.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
A separate vulnerability known as wp2shell was disclosed in July and is unrelated to pwn.ai’s research. Unlike Click2Shell, that flaw does not require a user to be logged in or to click a malicious link, and the U.S. Cybersecurity and Infrastructure Security Agency has listed it as being exploited in real-world attacks. There is currently no indication that Click2Shell has been exploited in the wild.
