Technical details and proof-of-concept code for a new vulnerability in the WordPress core, which researchers have named Click2Shell, were published. The vulnerability enables a remote code-execution chain that runs PHP code on the server without direct authentication by the attacker. WordPress fixed the flaw in version 7.1.1, released last week, but the publication of the proof-of-concept exploit makes updating affected sites more urgent.
How does the chain work?
Researcher Paulos Yibelo of penetration-testing platform pwn.ai discovered the vulnerability and reported it to WordPress on August 22. According to the report, a value taken from a theme-preview URL is parsed once through the Themes API on WordPress.org and then handled insecurely by JavaScript in the administrator’s browser.
This allows a theme from the official directory to be added to the site without the administrator explicitly installing it. Even if the theme is inactive, PHP code inside it can run while it is being previewed in the Customizer tool. To complete the attack, the attacker sends a specially crafted link, but a logged-in administrator must visit it.
What can happen after exploitation?
The researchers used a vulnerable theme as the second part of the chain to run PHP code specified by the attacker. The full report indicates that commands can be executed on the server, including modifying or deleting files and accessing user data and the wp-config.php file, which contains database credentials and authentication secrets.
This may allow the creation of malicious administrator accounts or the injection of harmful scripts into the site. The underlying flaw in WordPress Core 7.1.0 and earlier versions can also be used, according to the researcher, to force the site to install any other vulnerable theme available in the WordPress.org directory.
Who has the necessary permissions?
The attacker does not need a WordPress account, an installation nonce, or administrative privileges of their own. However, the Click2Shell chain does not work merely by sending the request; interaction by a logged-in administrator with the link is required. WordPress security company Patchstack stated that Author and Editor accounts do not have the permissions required to install themes.
The link may reach the administrator through targeted phishing or through a pre-existing XSS vulnerability that causes their browser to send the request. Therefore, the administrator-interaction requirement does not eliminate the severity of the flaw, but it defines the attack scenario and means that it is not a fully automated remote exploit.
What changes in practice?
WordPress fixed the issue by escaping the theme name before using it in a jQuery selector and restricting the selector to actual theme cards. Patchstack recommends updating to version 7.1.1 or later, especially after the publication of full details and proof-of-concept code.
For sites that cannot be updated immediately, Patchstack says that enabling the DISALLOW_FILE_MODS setting prevents the site from being forced to install the theme or a malicious plugin. This remains a temporary mitigation, not a substitute for updating the WordPress core and checking for unexpected changes or administrative accounts.