WordPress Click2Shell Flaw Enables Remote Code Execution: Update to Version 7.1.1

Technical details and a proof-of-concept (PoC) exploit have been published for a new cross-site request forgery (CSRF) vulnerability in WordPress known as “Click2Shell.” The flaw affects a core WordPress component and can lead to remote code execution (RCE).

The vulnerability does not have an official identifier, but it was fixed in WordPress version 7.1.1.

Click2Shell is a pre-authenticated RCE attack chain that can allow an attacker to install themes from the official WordPress.org catalog and execute arbitrary PHP files on a targeted server.

How the WordPress Click2Shell attack works

Security researcher Paulos Yibelo of the autonomous penetration-testing platform pwn.ai discovered Click2Shell and reported it to WordPress on August 22.

According to the researchers, “The value of a WordPress theme’s preview URL is interpreted once by the WordPress.org theme API and a second time by JavaScript in the administrator’s browser using a buggy method.”

This behavior allows an attacker to add a WordPress theme to a targeted website without the administrator explicitly installing it. Researchers also found that PHP can continue running while the WordPress Customizer previews an inactive theme.

Although the exploit does not require the attacker to authenticate, it does require a logged-in WordPress administrator to open a specially crafted URL.

The attack can begin with a link designed to install a vulnerable theme into the site’s theme catalog. When the Customizer preview loads PHP from the inactive theme, the code executes on the server.

To demonstrate the vulnerability, pwn.ai used a vulnerable WordPress theme as the second component in the attack chain to execute the attacker’s PHP code.

The researcher’s full technical report includes complete technical details and a proof-of-concept exploit for server-side remote code execution.

What attackers could do after exploiting Click2Shell

Successful exploitation could potentially allow attackers to modify or delete files and access wp-config.php, which contains user data, database credentials, and authentication secrets. An attacker could also use this access to create unauthorized administrator accounts or inject malicious scripts.

Although Yibelo demonstrated Click2Shell with a specific theme, the vulnerability could potentially exploit fundamental flaws in WordPress Core 7.1.0 and earlier to force other vulnerable themes into a site’s theme catalog.

Researchers said attackers do not need a WordPress account, an installation nonce, or unique administrative privileges. However, the attack still requires a logged-in administrator to access a crafted link.

Targeted phishing could expose WordPress administrators

WordPress security company Patchstack analyzed Click2Shell and highlighted that only administrators can trigger the attack chain. Author and editor accounts do not have the permissions required to install a theme.

Patchstack warned that attackers could exploit the flaw through targeted phishing or an existing cross-site scripting (XSS) vulnerability that sends requests to an administrator’s browser.

WordPress 7.1.1 fixes the vulnerability

WordPress addressed the core vulnerability in version 7.1.1 by escaping theme slugs before using them in jQuery selectors and restricting selectors to actual theme cards.

For administrators who cannot install the update immediately, Patchstack said that websites with DISALLOW_FILE_MODS enabled cannot be forced to install themes or malicious plugins.

However, administrators should update to the latest WordPress version as soon as possible, particularly now that technical details have been disclosed and a proof-of-concept exploit is publicly available.

Join Mikko Hypponen and security leaders from the NFL, Chanel, and Atlassian for a 2-hour digital summit about what will change with AI speed attacks, what defenders should stop doing, and how to verify, decide, fix, and revalidate at machine speed.

Please reserve your seat