Researchers have disclosed technical details and working exploit code for Click2Shell, a cross-site request forgery vulnerability affecting WordPress Core. The flaw received no CVE identifier but was remedied through the release of WordPress 7.1.1 last week.
The vulnerability represents a pre-authenticated remote code execution chain that permits attackers to deploy any theme available in the official WordPress.org repository and execute arbitrary PHP on the target server.
Paulos Yibelo, a security researcher at autonomous penetration testing platform pwn.ai, identified Click2Shell and disclosed it to WordPress on August 22.
How the attack works
The researchers explain that "a value from a WordPress theme-preview URL is interpreted once by the WordPress.org Themes API and a second, buggy methods by JavaScript in the Administrator's browser." This dual interpretation creates the vulnerability window.
An attacker can add a WordPress theme to a target website without requiring explicit administrator installation. Critically, even inactive themes can execute PHP code during a Customizer preview operation.
The exploit chain begins with a malicious link directing an administrator to install a vulnerable theme from the catalog. Once the Customizer preview loads the inactive theme's PHP code, execution occurs on the server. To prove the concept, pwn.ai leveraged a vulnerable WordPress theme as the second component to run attacker-controlled PHP.
Successful exploitation could grant attackers the ability to modify or delete files, access user information, and retrieve the wp-config.php file containing database credentials and authentication secrets. Attackers could then establish unauthorized admin accounts or inject malicious code into the site.
Attack requirements and scope
Although Yibelo's demonstration used a specific theme, the underlying flaw in WordPress Core 7.1.0 and earlier versions could be weaponized to force-install any vulnerable theme from the WordPress catalog.
Notably, attackers do not require a WordPress account, an installation nonce, or administrative credentials. However, the attack does require a logged-in administrator to click the crafted link.
WordPress security firm Patchstack noted that only administrators can trigger the vulnerability chain; Author and Editor user roles lack the permissions necessary to install themes.
https://www.youtube.com/embed/uLzyPYReGJs
Patchstack warned that attacks become feasible through targeted phishing campaigns or exploitation of existing cross-site scripting vulnerabilities that could cause an administrator's browser to automatically send the malicious request.
Mitigation and patching
WordPress addressed the Core vulnerability in version 7.1.1 by escaping the theme slug before inserting it into the jQuery selector and restricting the selector to legitimate theme cards.
For administrators unable to deploy the update immediately, Patchstack indicates that sites with DISALLOW_FILE_MODS enabled cannot be forced to install themes or malicious plugins.
Nevertheless, upgrading to the latest WordPress version remains strongly recommended, particularly given that comprehensive technical documentation and proof-of-concept code are now publicly available.