Critical WordPress XSS2Shell Flaw Enables Full Server Takeover
A simple login page vulnerability can lead to remote code execution.
1Vulnerability Discovery
Pwn researchers uncovered a critical security chain in WordPress dubbed XSS2Shell. The flaw triggers when a specially crafted payload is entered in the username field. A parsing flaw in PHP's strip_tags() function fails to filter HTML elements containing spaces. This allows attackers to inject malicious code into the login page. All WordPress versions from 4.7 to 7.0.3 are vulnerable to this exploit.
2DOM Clobbering Technique
The critical component involves a technique called DOM clobbering. The injected area element clobbers the window.ajaxurl property, putting it under attacker control. WordPress's login page loads user-profile.js script, which uses this fake ajaxurl value to initiate automatic requests. Browser features enable this request to trigger an attacker-controlled callback function.
3Admin Privilege Escalation
Attackers can hijack admin sessions using cross-window click techniques. By leveraging a 2022-discovered method, attackers trigger the application-password approval screen in a hidden window. This grants them valid Application Passwords for admin accounts. WordPress REST API accepts authenticated requests from any origin using these credentials.
4Remote Code Execution
With admin privileges, attackers can inject malicious JavaScript using unfiltered_html capability. These scripts can upload and execute arbitrary PHP plugins. Researchers' PoC demonstrated code execution as the web server user, confirmed via JSON response. All traces are cleaned post-exploitation, making detection difficult.
5Zero-Click Attack Chain
This vulnerability chain works without user interaction beyond visiting a malicious link. The entire process executes automatically, leading to RCE on default WordPress installations. The exploit primarily targets single-site WordPress instances, which represent a significant portion of installations.
6Patch Timeline
Researchers reported the flaw to WordPress on July 27. The WordPress team responded rapidly, releasing version 7.0.3 on August 6. The fix was backported to all actively maintained branches starting from WordPress 4.7. Security experts classify this as a critical update requiring immediate implementation due to server takeover risks.
7Industry Impact
WordPress powers over 43% of all websites, making this a potentially massive vulnerability. Small businesses and individual users with poor update practices face particularly high risk. Cybersecurity professionals urge all WordPress administrators to update immediately. This incident demonstrates how simple flaws can cascade into catastrophic security breaches.
8Recommended Mitigations
WordPress users must update to the latest version immediately. Administrators should review application password usage and restrict unnecessary privileges. File permissions on web servers should limit plugin installation capabilities. Security teams need to educate developers about modern attack vectors like DOM clobbering. This event underscores the critical importance of continuous security updates.
Original article: Security Affairs — WordPress'te Kritik XSS2Shell Açığı: Sunucu Ele Geçirme Riski