WordPress Click2Shell flaw enables server-side PHP execution

BleepingComputer reports that security researchers have published technical details and a proof-of-concept exploit for Click2Shell, a cross-site request forgery (CSRF) vulnerability in WordPress Core. The flaw has no official identifier and was fixed with WordPress 7.1.1.

The pre-authenticated remote code execution chain can make a target site install a theme from the official WordPress.org catalog and run an arbitrary PHP file. Researcher Paulos Yibelo of pwn.ai reported the issue to WordPress on August 22.

According to the researchers, a value in a theme-preview URL is processed by the WordPress.org Themes API and then mishandled by JavaScript in an administrator’s browser. This can add a theme without the administrator explicitly installing it. Even an inactive theme may execute PHP during a Customizer preview.

An attacker does not need a WordPress account, an installation nonce, or administrative privileges, but a logged-in administrator must visit a crafted link. Patchstack said targeted phishing or an existing cross-site scripting (XSS) flaw could deliver the request. Successful exploitation could allow file changes, access to user data and wp-config.php, creation of rogue administrator accounts, or malicious script injection.

The underlying flaw affects WordPress Core 7.1.0 and earlier. WordPress fixed it by escaping the theme slug and restricting the selector to actual theme cards. Patchstack also said DISALLOW_FILE_MODS prevents forced theme or plugin installation.