Do Son 
TL;DR
Security researchers uncovered a critical remote code execution chain in WordPress Core dubbed Click2Shell. The WordPress Click2Shell vulnerability allows an unauthenticated attacker to force a site to install a catalog theme and trigger malicious code. Consequently, site administrators must upgrade to WordPress 7.1.1 to protect their web servers.
Track every WordPress CVE the moment it's exploited.
Get free email alertsWhy It Matters
WordPress powers 43% of the web, representing an estimated 500 million websites. Because of this massive footprint, any Core vulnerability threatens millions of web environments simultaneously. Security researchers at pwn.ai discovered this security chain during audits of web management software.
The team identified a pathway where an attacker requires no administrative credentials on the target platform. Instead, a threat actor only needs an authenticated administrator to visit a crafted link. As the researchers noted, “No attacker WordPress account is needed. Just a single visit from a logged in user and the attacker owns the site.”
Fortunately, researchers confirmed that threat actors have not exploited the issue in the wild. WordPress resolved the problem quickly within a scheduled maintenance release. WordPress also awarded their maximum bounty payout to the research team. However, the vendor has not yet published an official CVE identifier for the finding.
How The Attack Works
The attack chain combines two separate weaknesses to achieve code execution. First, the exploit forces the WordPress administrative panel to install a catalog theme. Next, the chain triggers code execution within that newly placed theme package.
Discrepancy In Theme Slug Parsing
The initial stage begins within the WordPress theme installation interface. Administrators often preview themes using standard query parameters. However, the system handles theme parameters differently across two distinct environments. In a detailed report on the Click2Shell vulnerability chain published by pwn.ai, researchers explained this critical discrepancy.
Specifically, “The API reduces the value to an ordinary theme slug. The browser retains the original punctuation and places it inside a jQuery selector.” When an administrator opens a crafted link, the backend API canonicalizes the theme name to locate the catalog entry. Meanwhile, the browser script inserts the raw parameter into a client-side jQuery selector.
This selector injection breaks out of the HTML attribute string. Then, the script navigates through the theme card elements. As researchers observed, “The result is a theme preview that clicks Install by itself.” The browser triggers the authentic installation button without manual administrator interaction. WordPress uses the active session token to complete the theme download.
Executing PHP From Inactive Themes
Installing an inactive theme usually seems harmless to casual observers. Many developers assume that dormant themes cannot execute server-side code. However, the WordPress Customizer behaves differently during live site previews.
In their technical breakdown, the authors stated, “WordPress loads the theme’s PHP during a Customizer preview even while another theme remains active.” The Customizer loads the theme functions file into the active PHP runtime. During testing, researchers identified an insecure AJAX action inside Mobile Repair Zone. Over 40 other catalog themes also exhibited similar vulnerabilities.
The unprotected handler failed to verify user capabilities or security nonces. Furthermore, the endpoint accepted a remote package URL directly from user input. An attacker can therefore supply an external archive containing malicious PHP code. The server downloads the package, unzips the files, and executes the contents under the web server account.
Chaining To Remote Code Execution
By combining these flaws, an attacker achieves complete server compromise. An attacker first delivers a crafted link to an authenticated administrator. When the administrator visits the link, WordPress automatically installs the target catalog theme. Immediately afterward, a secondary request invokes the Customizer preview.
This second request triggers the unprotected AJAX installer inside the new theme. The server retrieves the external package and executes the malicious payload. The WordPress Click2Shell vulnerability demonstrates how minor parser inconsistencies create severe weaknesses. Consequently, a single click bypasses authentication boundaries and exposes entire server environments.
Affected Versions
The core parser weakness affects all WordPress versions prior to version 7.1.1. In addition, the pre-activation flaw resides in third-party catalog themes. Researchers specifically identified the weakness within Mobile Repair Zone version 2.5.4 and over 40 other themes. Because the attack relies on Core behavior, any unpatched WordPress deployment running vulnerable theme code remains exposed.
Patch Or Mitigation Steps
WordPress developers resolved the core issue in changeset 63664. In WordPress 7.1.1, the release notes stated that “Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org.” The updated script applies strict input escaping to the theme slug parameter before passing it to jQuery selectors. This change prevents attackers from injecting combinators and manipulating interface controls.
Administrators should update their WordPress sites to version 7.1.1 immediately. Furthermore, site owners should audit all installed themes and remove unused assets. Keeping inactive themes on a production server introduces unnecessary attack surface. Additionally, webmasters can restrict administrative panel access using IP allowlists. Applying these security measures protects systems from the WordPress Click2Shell vulnerability.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
