Researchers from pwn.ai have disclosed a critical flaw in the WordPress core, dubbed Click2Shell, that lets an attacker install a malicious theme and reach remote code execution with nothing more than a single link sent to an authenticated administrator.
The vulnerability received an isolated CVSS score of 7.1, but the complete attack chain that leads to code execution scores 9.6. Importantly, the issue resides in the WordPress core itself rather than any third-party plugin.
Versions from 6.0 through releases prior to 7.1.1 are affected. The attack exploits a divergence in how the WordPress.org theme directory and the administrator’s browser interpret the same URL parameter. The directory treats the value as a normal theme name, while the browser re-uses the original text inside code that locates an element on the page, causing the browser to automatically activate the install button.
No manual click on the install button, no password prompt, and no confirmation dialog are presented to the victim. The only prerequisite is that an authenticated administrator must open the malicious link; without an active admin session the attack cannot complete.
The fix is included in WordPress 7.1.1. Equivalent patches have also been released for all still-supported branches, extending back to the 4.7 release line. A CVE identifier is expected to be assigned shortly.
At the time of publication, researchers had not observed any exploitation of the flaw in real-world attacks. Because successful exploitation depends solely on convincing an administrator to visit a URL, organizations are advised to apply the update without waiting for confirmed incidents.
