Click2Shell

WordPress Click2Shell Flaw Chain Lets Attackers Achieve RCE via Single Admin Click

Researchers discovered a chain of vulnerabilities in WordPress core named Click2Shell that enables remote code execution without attacker authentication. The attack requires only that a logged-in administrator opens a specially crafted preview link, after which the interface automatically installs a malicious theme. Researcher Paulos Yibelo from pwn.ai found that inconsistent parameter handling between the theme directory API and browser JavaScript allowed the crafted URL to trigger installation without user interaction. A second vulnerable component, the Mobile Repair Zone 2.5.4 theme from the official directory, was used to load arbitrary PHP code and abuse an insecure AJAX handler for plugin installation. Successful exploitation grants full access to wp-config.php, database credentials, file modification rights, and the ability to create new administrators. WordPress addressed the issue in version 6.7.1 and backported fixes to supported branches, while the constant DISALLOW_FILE_MODS offers temporary mitigation by blocking theme and plugin changes.

Click2Shell Flaw in WordPress Core Enables Remote Code Execution via Single Malicious Link

Researchers at pwn.ai have disclosed Click2Shell, a vulnerability in the WordPress core that allows an attacker to install a malicious theme and achieve remote code execution simply by tricking an authenticated administrator into opening a crafted link. The isolated flaw carries a CVSS score of 7.1, but the full attack chain reaches 9.6. The issue stems from an interpretation mismatch between the WordPress.org theme directory and the administrator browser, causing the browser to automatically trigger the install button without any user confirmation or password prompt. Affected versions start from 6.0 and run up to but not including 7.1.1. The vulnerability has been fixed in WordPress 7.1.1 with backported patches released for all supported branches down to version 4.7. No exploitation in the wild had been observed at the time of disclosure, yet the low barrier of convincing an admin to click a link makes prompt patching essential.