WordPress 7.1.1 fixes Click2Shell forced theme install flaw

WordPress has fixed a flaw its discoverers call Click2Shell, shipping the repair as version 7.1.1 on September 17 together with other fixes to the core of one of the most widely used website publishing systems. The flaw allows a specially crafted web link, opened by an administrator who is already signed in, to install a theme from the official WordPress.org directory without anyone ever pressing the Install button. The security firm pwn.ai, whose researchers reported the problem, named the attack chain Click2Shell. Because this is a security release, WordPress advises site owners to update straight away, and so far there is no sign that the flaw has been used in real attacks.

The flaw works because two parts of WordPress read the same link differently. The WordPress.org directory treats the value carried in the link as an ordinary theme name and hands back a real, existing theme. The administrator's browser, meanwhile, reuses the original text of that link, punctuation and all, inside code that is meant to pick out a particular item on the page. Characters the attacker adds to the link steer that code to the Install button, and WordPress's own script clicks the button for them. Nothing is forged and no password is cracked: because the administrator is already logged in, their existing session supplies both the permission and the security token the install requires, so the attacker has to supply neither.

Installing a theme on its own is a limited outcome, and pwn.ai is explicit about that. The theme that gets installed is a genuine one from the directory, chosen by the attacker but not arbitrary. As the firm wrote of the core bug alone, "The Core bug does not accept an arbitrary theme ZIP by itself." The researchers then showed how the flaw could be combined with a second, separate weakness in a theme to reach code execution, which means the attacker's own program running on the site's server. An installed theme is not always idle: when WordPress builds a preview inside its Customizer tool, the part of the dashboard that lets an administrator see changes before they go live, it can load a theme's PHP code, the programming instructions the theme is written in, even before the theme is switched on. The theme pwn.ai used, Mobile Repair Zone, carried a second flaw, a background handler that fetched a web address taken from the request, downloaded a package and ran its code, with no check on the visitor's permission and no security token. Chained after the forced install, that handler ran the attacker's code on the server. Because the installed theme stays switched off, the site's own appearance does not change and nothing looks wrong at a glance.

pwn.ai rated the forced-install flaw on its own as high severity, with a CVSS score of 7.1. CVSS is a standard scale from 0 to 10 for how serious a security flaw is, and 7.1 falls in the high band. The researchers rated the full chain through to code execution as critical, at 9.6. WordPress has not published a severity rating of its own, and in its release it described the issue more narrowly: "Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org." No CVE identifier has been assigned yet. A CVE is a unique public reference number given to a known flaw so that everyone is discussing the same one, and pwn.ai says WordPress plans to add one.

The fix is present in WordPress 7.1.1, part of a security release whose repairs reach supported branches all the way back to version 4.7. The release notes confirm the flaw from version 6.0 up through the releases immediately before the fix. Site owners should install 7.1.1, or the matching update for whichever branch they run, and sites set to update automatically will receive it on their own. If an update cannot be applied at once, it is worth knowing that neither WordPress nor pwn.ai offered a separate workaround, and that the attack still requires a logged-in administrator to open the attacker's link in the first place. Updating WordPress core closes the demonstrated attack whatever theme a site runs.

For teams that would rather not track core releases by hand, AEU Hosting runs managed WordPress hosting in which the platform is kept updated as part of the service, which is the step that closes this flaw for a site.

Click2Shell is not the first WordPress core flaw pwn.ai has reported in recent weeks. In August, WordPress fixed a similar flaw the firm found in the login screen, which the researchers also chained to code execution, and there too WordPress described the risk in narrower terms than the researchers did. A different WordPress core flaw disclosed in July, called wp2shell, is not connected to pwn.ai's work. That one needs no login and no click from the victim, and the U.S. cybersecurity agency CISA has listed it as exploited in real attacks. Click2Shell has not been, which is the main reason the sensible response here is prompt patching rather than emergency clean-up. The safest position for any site remains a current core, a short list of themes and add-ons that are actually in use, and administrators who know better than to follow unexpected links while they are signed in.