WordPress Fixes Click2Shell Security Flaw That Can Lead to Remote Code Execution

A new WordPress security flaw can let attackers force vulnerable websites to install themes. Researchers say the flaw can then lead to remote PHP code execution.

The flaw, known as Click2Shell, affects WordPress Core and does not require an attacker account. However, it does require an administrator to click on a special link for the attack to be successful.

Click2Shell can Force Theme Installation

A security researcher, Paulos Yibelo, and the pwn.ai team discovered a vulnerability, which they communicated to WordPress on August 22, this year. Their report revealed that the flaw impacts all the versions of WordPress older than 7.1.1. and the company fixed the issue in version 7.1.1 – which it released on September 17.

The official release addressed 11 security issues across WordPress. It also included fixes for 17 Core bugs and 21 Block Editor bugs. WordPress did not assign a CVE identifier to Click2Shell when researchers published their findings. The issue appears in the security release as a problem involving specially crafted URLs.

The flaw uses a weakness in WordPress theme previews. A theme-preview URL can carry a value that different parts of WordPress process differently. The WordPress.org Themes API first handles the value as a theme slug. JavaScript in the administrator’s browser then processes the same value again.

The browser uses the value inside a jQuery selector. The vulnerable code failed to properly escape the theme slug before using it. This behavior allows an attacker to manipulate the selector. As a result, the browser can trigger the theme installation process without normal administrator interaction.

The administrator does not need to click an installation button. The attack can therefore turn a simple visit into a forced theme installation.

The Attack can Reach PHP Code

The forced installation alone does not provide full server control. Researchers chained the Core flaw with a separate weakness inside a vulnerable theme. The researchers demonstrated the chain using the Mobile Repair Zone theme. They found a flaw that allowed PHP code to run during a Customizer preview.

The important detail involves inactive themes. WordPress can load an inactive theme during a Customizer preview. Therefore, the attacker does not need to activate the installed theme. The website can continue using its original active theme during the attack.

Researchers also found a vulnerable AJAX handler within the demonstration theme. That handler lacked important security checks. The handler could accept a plugin package and process it through the server. This behavior gave the researchers a path toward executing attacker-controlled PHP.

The complete chain starts with a crafted URL. A logged-in administrator visits that URL through a browser. Next, WordPress installs a selected theme from its official catalog. The Customizer then loads the inactive theme.

The vulnerable theme processes its PHP code during that preview. Its insecure functionality can then allow further server-side actions. Finally, the attacker can achieve remote code execution under the WordPress server account. The attack does not require the attacker to own a WordPress account. It also does not require the attacker to possess an installation nonce.

Why the Vulnerability Creates Serious Risk

An attacker may obtain total control of a compromised website following a successful remote code execution. The exact conditions of the attack depend on the version of the server and the configuration of WordPress. An attacker could modify or delete website files after gaining code execution.

They could also access sensitive information stored by the WordPress installation. Similar Windows attacks have also targeted memory protections, Microsoft Defender, and driver security to expand what attackers can do on compromised systems.

One important target is the wp-config.php file. That file can contain database credentials and authentication-related secrets. Moreover, an attacker could use stolen credentials to expand access. They could also create unauthorized administrator accounts on a compromised website. Malicious scripts could also be injected into website files. Such scripts could redirect visitors, steal information, or damage website content. However, Click2Shell still requires a specific condition.

A logged-in administrator must visit the crafted link of the attacker. This requirement gives attackers a clear social engineering route. For example, you can use the vulnerability in several ways to launch an attack. They can craft phishing emails with malicious links. Also, an existing flaw in the web application can help them accomplish the task. Such a flaw could make the browser of an administrator send the required request.

The analysis from Patchstack also notes that lower-level WordPress roles cannot trigger the same installation action. Author and Editor accounts do not have the required permission. The attack therefore focuses on users with administrator-level access. Protecting those accounts remains important even after applying the Core update.

WordPress Releases a Fix

WordPress fixed Click2Shell in version 7.1.1. The patch changes how WordPress handles the theme slug inside the JavaScript selector. The updated code escapes the URL-derived value before placing it into the selector. It also limits the selector to actual theme cards.

This change prevents injected selector characters from being treated as part of the selector structure. Instead, WordPress treats them as ordinary characters within the theme slug. Also, the fix blocks the automatic theme installation path used by the Click2Shell attack.

WordPress encourages site administrators to implement the security update right away. Also, researchers from pwn.ai issued technical details and a proof of concept after the release of the patch. Public exploit details increase the need for timely updates.

Site owners who cannot update immediately should review their security settings. Patchstack says the DISALLOW_FILE_MODS setting can prevent forced theme installation. Administrators should also review installed themes and remove unnecessary ones. They should pay attention to inactive themes because the attack can involve them.

The wider lesson concerns the interaction between WordPress Core and third-party themes. A Core weakness can become more dangerous when attackers combine it with another vulnerable component. Therefore, administrators should keep both WordPress Core and themes updated. They should also restrict administrator access and treat unexpected links with caution.