WordPress Patches ‘Click2Shell’ Vulnerability to Prevent Remote Code Execution

WordPress has released security patches to address a vulnerability dubbed ‘Click2Shell’, which could allow attackers to achieve remote code execution (RCE) on a website.

The flaw was discovered and reported by researchers at pwn.ai. It enables an unauthenticated attacker to use specially crafted URLs to automatically install and preview inactive themes on a WordPress site.

Technical Exploitation Risk

While an inactive theme might appear to pose a low risk, pwn.ai found that the vulnerability can be leveraged to execute malicious code. The issue arises because a value in the WordPress theme-preview URL is interpreted differently by the themes API and the JavaScript running in an administrator’s browser. The API reduces the value to an ordinary theme slug, but the browser retains the original punctuation and places it inside a jQuery selector.

This discrepancy allows attackers to force the installation of a selected theme from the official WordPress.org catalog without the administrator’s knowledge or consent. Researchers identified over 40 third-party themes that could be abused to execute PHP code while they are inactive. Because WordPress loads PHP code during the Customizer preview—even when a different theme is currently active—an attacker can use an unprotected installer to point to a crafted plugin package for execution under the WordPress server account.

Crucially, the attack does not require a WordPress account. According to pwn.ai, a single visit from a logged-in administrator to a malicious URL is sufficient for an attacker to gain control of the site. The exploit is difficult to detect because the site’s primary theme remains active throughout the process.

Remediation and Patching

The ‘Click2Shell’ vulnerability does not currently have a CVE identifier. WordPress addressed the flaw, along with 10 other security vulnerabilities, in version 7.1.1 of the content management system.

Security updates have also been released for older iterations of the software, dating back to WordPress 4.7. Site administrators are advised to update their installations to the latest available version immediately to mitigate the risk of remote code execution.