WordPress Patches ‘Click2Shell’ Vulnerability

WordPress released version 7.1.1 last week to address 11 security vulnerabilities, including a significant flaw known as Click2Shell. This vulnerability could enable attackers to install malicious themes and execute PHP code on a WordPress site without requiring an account. According to pwn.ai, the issue arises because the WordPress theme API and a user’s browser interpret theme URLs differently. Specifically, the API reduces the value to an ordinary theme slug, while the browser retains the original punctuation and places it inside a jQuery selector.

This allows an unauthenticated attacker to force the installation of an attacker-selected theme on the administrator’s site, fetching it from the official WordPress.org catalog without the administrator’s knowledge or consent. pwn.ai discovered that over 40 third-party themes on WordPress could be abused for PHP code execution while inactive, as the theme loads their PHP code during Customizer preview even if another theme is active.

Because the theme is inactive, an attacker could abuse their unprotected installers to point to a crafted plugin package that could be executed under the WordPress server account. Importantly, an administrator might not notice the abnormal behavior, given that the site’s main theme remains active during the exploit. WordPress patched Click2Shell and the remaining 10 vulnerabilities, and paid pwn.ai a $300 reward, its maximum bug bounty amount. Updates were also released for older WordPress iterations, all the way back to WordPress 4.7.