WordPress Click2Shell Flaw Enables Silent Theme Installation
Vulnerability chains to code execution via forced theme installs.
1Silent Theme Installation Exploit
A newly patched WordPress vulnerability allows attackers to forcibly install themes via crafted links opened by logged-in admins, without requiring manual clicks. The flaw leverages mismatched URL parsing between WordPress.org and admin interfaces. While the installed theme remains inactive, this creates an entry point for further exploits when combined with vulnerable themes.
2Click2Shell Attack Chain
Security firm pwn.ai demonstrated how the core flaw (CVSS 7.1) chains with theme vulnerabilities to achieve remote code execution (CVSS 9.6). Their PoC used Mobile Repair Zone theme, which contained unauthenticated package execution. The attack requires admin session hijacking but no direct interaction beyond link opening.
3Technical Root Cause
The vulnerability stems from inconsistent URL handling - WordPress.org treats link parameters as theme names while admin interface interprets them as DOM selectors. Attackers inject characters that trigger automatic 'Install' button clicks. Existing admin sessions provide all necessary permissions silently.
4Patch and Version Impact
Fixed in WordPress 7.1.1 (backported to supported branches since 4.7), the vulnerability affects versions 6.0+. No workarounds exist beyond immediate updating. Automatic updates will deploy the fix, but manually managed sites require urgent attention due to the high-severity rating.
5Stealthy Attack Characteristics
The forced install leaves no visible traces - themes remain deactivated by default. Preview functionality in WordPress Customizer can execute theme PHP code pre-activation, enabling hidden exploitation. Attackers need both the core flaw and vulnerable theme for full code execution.
6Contextual Risk Assessment
While no in-the-wild exploitation has been observed, this follows pwn.ai's August discovery of a similar chained vulnerability. Unlike the unrelated wp2shell flaw (actively exploited per CISA), Click2Shell requires admin session compromise but demonstrates WordPress's persistent URL parsing risks.
7Enterprise Security Implications
The attack highlights risks in WordPress's permission model where admin sessions enable silent actions. Organizations should enforce principle of least privilege, segment admin access, and monitor for unusual theme installations. The vulnerability particularly threatens multisite installations.
8Proactive Defense Strategy
Beyond patching, security teams should audit installed themes for similar execution flaws, implement strict CSP headers, and educate administrators about link risks. The case underscores the importance of coordinated vulnerability disclosure - WordPress's advisory understated the chained risk compared to researchers' findings.
Original article: The Hacker News — WordPress Click2Shell Flaw Enables Silent Theme Installation