WordPress Patches ‘Click2Shell’ Vulnerability
WordPress 7.1.1 patches Click2Shell, a theme-preview flaw that can lead to remote code execution.
WordPress 7.1.1 fixes 11 vulnerabilities, including Click2Shell, which does not yet have a CVE identifier. pwn.ai said a crafted theme-preview URL is interpreted differently by the themes API and by JavaScript in an administrator’s browser, so an unauthenticated attacker can install a chosen WordPress.org theme without consent. More than 40 third-party themes execute PHP while inactive during Customizer preview, and one visit by a logged-in administrator can lead to code execution under the WordPress server account. Fixes were backported through WordPress 4.7, pwn.ai received a $300 bounty, and it published a proof of concept.
- Click2Shell has no CVE; pwn.ai published details and proof-of-concept code.
- A crafted URL can silently install an attacker-chosen WordPress.org theme.
- More than 40 inactive themes can execute PHP during Customizer preview.
- Fixes were backported to WordPress 4.7; the bounty paid was $300.
From the original article
2 min read at securityweek.com
The bug lets attackers automatically install and preview themes and could lead to remote code execution. The post WordPress Patches ‘Click2Shell’ Vulnerability appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.