WordPress Click2Shell flaw lets hackers execute PHP on the server
Public PoC shows WordPress Click2Shell can run PHP if an administrator opens a crafted link.
Researcher Paulos Yibelo of pwn.ai published technical details and a proof of concept for Click2Shell, a cross-site request forgery chain in WordPress Core 7.1.0 and earlier that has no CVE. A logged-in administrator who opens a crafted link can be made to install a catalog theme whose PHP then runs during Customizer preview, potentially exposing wp-config.php and allowing rogue admin accounts. The attacker needs no WordPress account or installation nonce, but Author and Editor roles cannot trigger it. WordPress fixed the issue in 7.1.1; Patchstack notes DISALLOW_FILE_MODS also blocks the forced install. Exploitation in the wild is not reported.
- Click2Shell is a CSRF-to-RCE chain in WordPress Core 7.1.0 and earlier.
- A logged-in administrator must open a crafted link; the attacker needs no account.
- A public proof of concept can force-install a theme and execute PHP.
- WordPress 7.1.1 escapes the theme slug and restricts the selector.
- DISALLOW_FILE_MODS blocks forced theme or plugin installation.
- Vendors
- WordPress
- Products
- WordPress
- Organizations
- Patchstackpwn.ai
From the original article
2 min read at bleepingcomputer.com
Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed 'Click2Shell' that affects the platform's Core component. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.