WordPress Fixes 'Click2Shell' Vulnerability with Security Update

Post Views: 16

WordPress recently released updates to resolve 11 security flaws, including a critical issue that could enable remote code execution (RCE) through manipulated theme-preview requests.

Critical Vulnerability Details

The vulnerability, designated as Click2Shell, lacks a formal Common Vulnerabilities and Exposures (CVE) identifier but was disclosed by pwn.ai, which reported the flaw to the platform.

The flaw arises from inconsistent handling of theme-preview URLs by the WordPress themes API and JavaScript components within an administrator’s browser. Specifically, the API normalizes the URL parameter into a standard theme slug, while the browser retains special characters and uses them in a jQuery selector.

Exploit Mechanism

This discrepancy allows an unauthenticated attacker to trigger the automatic installation of a malicious theme from the official WordPress.org repository without user consent.

Although the compromised theme remains inactive, pwn.ai highlighted that over 40 third-party themes hosted on WordPress could be exploited to execute PHP code during the Customizer preview process. This occurs because WordPress loads PHP scripts from these themes even when a different theme is active.

Technical Explanation

Attackers could leverage this to deploy malicious plugins that execute under the WordPress server account. The exploit does not require an existing attacker account. A single interaction with a malicious URL by an authenticated user is sufficient to compromise the site.

pwn.ai provided detailed technical analysis and proof-of-concept (PoC) code to demonstrate the vulnerability’s exploitability.

Patch and Updates

WordPress addressed the issue in version 7.1.1, alongside 10 other vulnerabilities. The patch also includes updates for older versions dating back to 4.7.

The company awarded pwn.ai a $300 bug bounty, its highest reward for a single disclosure.

Security Implications

The vulnerability underscores risks associated with theme-preview mechanisms and the potential for indirect code execution through third-party components.

Security teams are advised to apply the latest updates promptly and review theme configurations to mitigate exposure.

“This flaw highlights the importance of secure URL handling and the need for rigorous testing of theme-preview functionalities.”