Significant Vulnerability Uncovered in WordPress: Click2Shell
A recently unveiled vulnerability within WordPress Core, termed Click2Shell, presents a harrowing risk whereby unauthenticated adversaries can covertly compel a logged-in Administrator’s browser to install a malicious theme.
This alarming sequence of events can culminate in remote code execution (RCE) with merely a single click on a deceptive link.
Researchers from PWNAI revealed that the theme-preview URL parameter in WordPress is interpreted inconsistently across two disparate components.
The WordPress.org Themes API effectively normalizes the theme parameter into a valid slug, whereas the JavaScript on the client side, located inwp-admin/js/theme.js, retains the attacker-supplied string in its raw form, directly injecting it into a jQuery CSS selector.
Analyzing the Click2Shell Flaw
By crafting a value such astwentytwenty"]>*>*>*/*, an attacker could navigate outside the intended selector bounds.
This maneuver permits the WordPress script to automatically activate the genuine “Install” button, bypassing any required admin interaction, nonce theft, or need for install_themes capabilities from the attacker’s side.
The compromised authenticated session, on its own, facilitates the installation of an authentic catalog theme without its activation.
PWNAI subsequently discovered that WordPress loads a theme’s functions.php file during the Customizer preview, even while the theme remains dormant.
When combined with an unrelated flaw in the (then-current) Mobile Repair Zone 2.5.4 theme, which featured an AJAX handler lacking nonce or capability verifications and accepted attacker-controlled plugin package URLs, the vulnerability escalated from forced installation to complete server-side PHP execution.
The resulting sequence of events is alarming: crafted link → compelled theme installation → Customizer loads code from the inactive theme → unprotected AJAX installer retrieves the attacker’s plugin → PHP executes under the web server account, effectively surrendering control of the entire site.
WordPress addressed the selector injection vulnerability in changeset 63664, part of the maintenance and security release issued on September 17, 2026, encompassing 11 crucial fixes.
This patch confines matches to authentic div.theme elements and applies $.escapeSelector() to neutralize the effects of injected selector syntax.
The research team at pwn.ai received recognition from WordPress and was awarded the maximum bug bounty, although no CVE identifier had been assigned at the point of disclosure.
Researchers categorized the isolated forced-install mechanism as High severity (CVSS 3.1: 7.1), while the complete exploit chain achieved a Critical rating (CVSS 3.1: 9.3), considering user interaction mitigates the impact.
This vulnerability affects all WordPress Core versions released before 7.1.1. Given that WordPress supports approximately 43% of the entire internet, translating to roughly 500 million websites, the breadth of this flaw is considerable, although its exploitation necessitates the presence of an additional theme-side vulnerability.
Administrators are urged to promptly update to WordPress version 7.1.1 and conduct a thorough audit of installed themes, including inactive ones, in search of unauthenticated or inadequately protected AJAX handlers—a category of vulnerabilities identified in over 40 third-party catalog themes during the investigation.
Source link: Cyberpress.org.
