WordPress Click2Shell flaw lets hackers execute PHP on the server

Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed 'Click2Shell' that affects the platform’s Core component.

The security problem does not have an official identifier but was addressed last week with the release of WordPress version 7.1.1.

It is a pre-authenticated remote code execution chain that allows an attacker to install any theme in the official WordPress.org catalog and run an arbitrary PHP file.

Security researcher Paulos Yibelo of the autonomous penetration testing platform pwn.ai discovered Click2Shell and reported it to WordPress on August 22.

The researchers explain that "a value from a WordPress theme-preview URL is interpreted once by the WordPress.org Themes API and a second, buggy methods by JavaScript in the Administrator's browser."

This enables an attacker to add a WordPress theme to a target website without the administrator explicitly installing it. The researcher found that even if inactive, a theme could still execute PHP during a Customizer preview.

It should be noted that even if the attacker does not need to authenticate, a logged-in administrator needs to visit a crafted URL for the Click2Shell exploit to work.

An attack could start with a crafted link that leads to installing a vulnerable theme in the catalog. Once the Customizer preview loads the inactive theme's PHP, the code is executed on the server.

To demonstrate the issue, pwn.ai used a vulnerable WordPress theme as the second component in the chain that executed the attacker's PHP code.

The researcher's full technical report provides a complete proof-of-concept (PoC) exploit for achieving server-side remote code execution.

Executing code this way could enable file modification and deletion, access to user data, and the ‘wp-config.php’ file that contains database credentials and authentication secrets. An attacker could leverage this access to create rogue admin accounts or inject malicious scripts.

Although Yibelo demonstrated Click2Shell using a particular theme, the underlying flaw in WordPress Core 7.1.0 and earlier could be leveraged to force-install any other vulnerable theme in the WordPress catalog.

The researcher notes that an attacker does not need a WordPress account, an installation nonce, or their own administrative privileges. However, a Click2Shell attack requires a logged-in administrator to visit the crafted link.

WordPress security firm Patchstack analyzed Click2Shell and highlights that only an administrator can trigger the chain, while Author and Editor accounts lack the required permission to install themes.

The company warned that attacks are possible via targeted phishing or an existing cross-site scripting (XSS) flaw that makes the administrator’s browser send the request.

WordPress fixed the Core vulnerability in version 7.1.1 by escaping the theme slug before using it in the jQuery selector and restricting the selector to actual theme cards.

For administrators who cannot install the update immediately, Patchstack says that websites with ‘DISALLOW_FILE_MODS’ enabled cannot be forced to install the theme or a malicious plugin.

However, switching to the latest WordPress version is a strong recommendation, especially with complete technical details and a PoC already public.