New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution
WordPress 7.1.1 patches Click2Shell, a flaw letting crafted links force-install themes on admin visits, chainable to remote code execution; no exploitation observed.
Researchers at pwn.ai disclosed Click2Shell, a WordPress core flaw where a crafted link, opened by a logged-in administrator, silently installs an attacker-chosen theme from WordPress.org using the admin's own session and security token. The forced install alone is rated CVSS 7.1; chained with an unauthenticated background download handler in the Mobile Repair Zone theme, it reaches CVSS 9.6 remote code execution. WordPress fixed the bug in 7.1.1 released September 17, with fixes backported to supported branches down to 4.7. No CVE has been assigned yet and there is no sign of exploitation, unlike the separate, CISA-listed wp2shell flaw.
- Two WordPress components parse the same link differently, letting the site's own script click the Install button.
- Full code execution required a second flaw in the installed Mobile Repair Zone theme's background handler.
- Fix shipped September 17 in WordPress 7.1.1, backported to supported branches back to 4.7.
- Installed themes stay inactive, so forced installs leave no visible change to the site.
- No CVE assigned and no real-world attacks observed, unlike the distinct exploited wp2shell bug.
From the original article
3 min read at thehackernews.com
WordPress today released patches to fix a new set of vulnerabilities in its core software, one of which could allow a crafted web link, opened by a logged-in administrator, to install a theme from the official WordPress. org directory without anyone clicking Install. The security firm pwn.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.