Researchers have identified a chain of vulnerabilities in WordPress core dubbed Click2Shell that permits remote code execution on the server without any attacker credentials. The attack succeeds when an authenticated administrator simply opens a maliciously prepared preview link.
The flaw stems from inconsistent handling of a single URL parameter used for theme previews. The theme directory API sanitizes the value and selects a legitimate theme, while the JavaScript running in the administrator’s browser inserts the original unsanitized string into a jQuery selector. This allows the prepared URL to force the WordPress interface to click the install button automatically.
No manual selection of “Install” or “Activate” is required from the administrator, and the installed theme remains inactive so the site continues to function normally from the outside. To achieve full remote code execution, the researchers combined the core issue with a second vulnerable component: the Mobile Repair Zone 2.5.4 theme available in the official directory.
During preview, WordPress loads the theme’s PHP code, after which an insecure AJAX handler permits downloading and executing an arbitrary plugin. The attacker can then read wp-config.php, steal database keys, modify files, create new administrator accounts, and inject scripts.
The attack is not fully automatic; it requires a logged-in administrator with the Administrator role to open the link. Authors and Editors lack the necessary privileges. Delivery can occur through targeted phishing or an existing XSS vulnerability.
WordPress resolved the issue in version 6.7.1 and released patches for all supported older branches. Because full technical details and proof-of-concept code are already public, immediate updating is strongly recommended. As a temporary safeguard, administrators can set the DISALLOW_FILE_MODS constant to prevent installation of themes and plugins, but applying the official patches remains the only complete fix.
