WordPress released critical security patches on September 17 to address vulnerabilities in its core software. The most serious flaw allows attackers to force theme installations through a specially crafted link when opened by a logged-in administrator.

Security researchers at pwn.ai discovered the vulnerability and named the attack method Click2Shell. The flaw affects WordPress installations and can be chained with other weaknesses to achieve remote code execution on vulnerable servers.

How the WordPress Click2Shell Attack Works

The Click2Shell vulnerability exploits how WordPress handles theme installation links. When an administrator clicks a malicious link, WordPress automatically installs a theme from the official WordPress.org directory without requiring additional confirmation or manual installation steps.

The installed theme remains inactive, meaning the website’s appearance stays unchanged. This makes the attack difficult to detect through casual observation. However, the security implications extend beyond simple theme installation.

According to pwn.ai researchers, the core vulnerability alone cannot install arbitrary theme files. Instead, it forces the installation of legitimate themes from the WordPress directory. The attack leverages a parsing discrepancy between two WordPress components that interpret the same URL differently.

Chain Attack Enables Code Execution

The real danger emerges when attackers combine Click2Shell with secondary vulnerabilities in installed themes. Researchers demonstrated this by pairing the core flaw with a weakness in the Mobile Repair Zone theme.

WordPress can execute theme code through its Customizer preview feature, even when themes remain inactive. The Mobile Repair Zone theme contained a vulnerable background handler that downloaded and executed code from remote URLs without permission checks or security token validation.

This combination allowed attackers to achieve remote code execution on targeted servers. The researchers assigned a CVSS score of 7.1 for the forced-install vulnerability alone, and 9.6 for the complete attack chain leading to code execution.

Affected Versions and Security Updates

The vulnerability affects WordPress versions 6.0 through 7.1.0. WordPress addressed the issue in version 7.1.1, released September 17 as a security update. The patches extend to all supported branches dating back to WordPress 4.7.

WordPress described the issue in their release notes as allowing “specially crafted URLs to automatically install and preview an inactive theme from WordPress.org.” No CVE identifier has been assigned yet, though WordPress plans to issue one.

Currently, there is no evidence of active exploitation in real-world attacks. The vulnerability requires a logged-in administrator to click the malicious link, which provides some natural protection against widespread exploitation.

Recommended Actions for Site Administrators

WordPress strongly recommends immediate updates to version 7.1.1 or the corresponding security release for your installed branch. Sites configured with automatic updates will receive the patch without manual intervention.

Neither WordPress nor pwn.ai provided alternative workarounds for sites unable to update immediately. The primary defense remains updating to the patched version as quickly as possible.

Administrators should verify their WordPress installation version and apply updates through the dashboard or manually via file replacement. Updating WordPress core effectively closes this vulnerability regardless of which themes are installed on the site.

Context Within Recent WordPress Security Issues

Click2Shell represents the second major WordPress core vulnerability discovered by pwn.ai in recent months. In August, the security firm reported a similar flaw affecting the login screen, which WordPress also patched after disclosure.

This vulnerability differs from the unrelated wp2shell flaw disclosed in July. That separate issue required no authentication or user interaction, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed active exploitation in real attacks.

The pattern of vulnerabilities demonstrates the importance of maintaining current WordPress installations. Regular security updates remain the most effective defense against emerging threats and known vulnerabilities in the platform.

Site owners should establish update routines and monitor security announcements from WordPress. Automated updates provide the fastest protection but require testing procedures to prevent conflicts with custom code or third-party plugins.

Original Source: thehackernews.com