WordPress Click2Shell: Core 7.1.1 fixes PHP code execution

WordPress Click2Shell is the name security researchers have given to a cross-site request forgery (CSRF) flaw in WordPress Core, the central set of files that make up WordPress itself, as opposed to the plugins and themes added on top of it. The bug has been fixed in WordPress version 7.1.1, but technical details and a working proof-of-concept exploit are already public, which puts site owners under pressure to update promptly. CSRF is a trick in which an attacker gets your own logged-in browser to send a request you never intended to make. You do not have to download anything or type a password, because the website trusts the request as if you had made it yourself.

The vulnerability was discovered by security researcher Paulos Yibelo, who works at pwn.ai, an autonomous penetration testing platform. According to the published research, Yibelo reported the problem to WordPress on August 22. The flaw has no official security identifier, and it was addressed in the WordPress 7.1.1 release. The researcher's full technical report provides a complete proof of concept for achieving server-side remote code execution, which means the ability to run the attacker's own code on the machine that hosts the website.

The mechanism at the heart of Click2Shell, as the researchers describe it, is that a value from a WordPress theme preview URL is interpreted twice: once by the WordPress.org Themes API, and a second time by a buggy method in JavaScript running inside the administrator's browser. The WordPress.org Themes API is the catalogue service that WordPress installations contact when they look up themes from the official directory, and a theme is a pack of design and code files that changes how a site looks. Because the same value is read again by the browser's JavaScript, an attacker can add a theme to a target website without the administrator ever installing it. Yibelo also found that a theme can still run PHP code during a Customizer preview even when it is inactive. A Customizer preview is the screen in WordPress that shows a live preview of design changes before they are saved. PHP is the programming language WordPress is written in, so code running as PHP on the server runs with the website's own privileges.

An attack could start with a crafted link that leads to a vulnerable theme being installed from the catalogue. Once the Customizer preview loads that inactive theme's PHP, the attacker's code is executed on the server. To demonstrate the issue, pwn.ai used a vulnerable WordPress theme as the second component in the chain. According to the research, the attacker does not need a WordPress account, an installation nonce, or administrative privileges of their own. A nonce is a one-time security code WordPress uses to check that a request came from its own pages rather than from an attacker, so the fact that it is not required is what makes the chain notable. What the attack does require is that a logged-in administrator visits the crafted URL, which makes the chain pre-authenticated for the attacker but not automatic.

Code execution of this kind is a serious problem for a website. The findings state that it could allow an attacker to modify and delete files, reach user data, and access wp-config.php, the WordPress configuration file stored on the server that contains the database credentials and the authentication secrets for the site. With that access, an attacker could create rogue administrator accounts or inject malicious scripts into the site's pages.

Yibelo demonstrated Click2Shell with one particular theme, but the underlying flaw in WordPress Core 7.1.0 and earlier could be leveraged to force-install any other vulnerable theme in the WordPress catalogue. The WordPress security firm Patchstack analyzed the chain and highlights that only an administrator can trigger it, because Author and Editor accounts lack the required permission to install themes. Patchstack also warns that attacks are possible through targeted phishing, meaning an email or message designed to persuade an administrator to click, or through an existing cross-site scripting (XSS) flaw. XSS is a bug that lets an attacker run code in another person's browser, which in this case would make the administrator's browser send the request on its own.

WordPress fixed the Core vulnerability in version 7.1.1 by escaping the theme slug before using it in the jQuery selector and restricting the selector to actual theme cards. In plain language, the theme slug is the short name that identifies a theme, and a jQuery selector is a piece of code that finds elements on a page; the fix stops the name from being read as anything other than a name, and stops the code from matching anything other than real theme cards.

For administrators who cannot install the update immediately, Patchstack says that websites with DISALLOW_FILE_MODS enabled cannot be forced to install the theme, or a malicious plugin. That setting stops WordPress from installing or updating files through the dashboard, which closes this particular chain, but it also means that updates have to be applied in another way. Switching to the latest WordPress version remains the strong recommendation, especially now that the complete technical details and a proof of concept are public. For site owners who would rather not track release dates themselves, managed WordPress hosting such as AEU Hosting is built around routine platform maintenance of this kind, and its plan page sets out exactly what is covered so a reader can check it before relying on it.