Security researchers have disclosed technical details and proof-of-concept code for a new WordPress vulnerability called Click2Shell. Attackers can exploit the flaw to install themes and execute arbitrary PHP code on vulnerable servers.
WordPress 7.1.1 Fixes Click2Shell
The WordPress Click2Shell flaw affects the platform’s Core component. WordPress addressed the security issue with the release of version 7.1.1.
The vulnerability does not currently have an official tracking identifier. However, researchers classify it as a pre-authentication remote code execution chain.
Security researcher Paulos Yibelo discovered the issue through the autonomous penetration testing platform pwn.ai. He reported it to WordPress on August 22.
The flaw affects WordPress 7.1.0 and earlier versions.
Attack Exploits Theme Preview Processing
Click2Shell stems from the way WordPress processes values within theme preview URLs.
First, the WordPress.org Themes API interprets a value from the URL. JavaScript in the administrator’s browser then processes it again through a vulnerable method.
Consequently, an attacker can force a target website to install a theme from the official WordPress catalogue. The administrator does not need to approve the installation directly.
Moreover, an inactive theme can execute PHP code when the Customizer loads its preview.
An attack begins when a logged-in administrator visits a specially crafted URL. The link can trigger the installation of a vulnerable theme from the catalogue.
Next, the Customizer previews the inactive theme and loads its PHP code. The server then executes the attacker-controlled code.
Exploit Requires Administrator Interaction
Attackers do not need a WordPress account, installation nonce or administrative privileges. However, they must convince a logged-in administrator to open the malicious link.
Lower-privileged Author and Editor accounts cannot trigger the exploit chain. Those roles lack permission to install themes.
Attackers could distribute the crafted URL through targeted phishing messages. Alternatively, they could combine Click2Shell with an existing cross-site scripting vulnerability.
In the second scenario, the XSS flaw could instruct an administrator’s browser to send the malicious request automatically.
PHP Execution Creates Serious Security Risks
Researchers demonstrated the attack by combining the Core flaw with a vulnerable WordPress theme. That theme served as the second part of the remote code execution chain.
Successful exploitation could allow attackers to modify or delete website files. They could also access user information and sensitive configuration data.
For example, the wp-config.php file often contains database credentials and authentication secrets. Access to this information could help attackers compromise the entire website.
Threat actors could also create unauthorised administrator accounts or inject malicious scripts into website pages.
Although researchers used one specific theme for their demonstration, the flaw has broader implications. Attackers could force-install any vulnerable theme available through the official catalogue.
WordPress Restricts Theme Selection Process
WordPress fixed the vulnerability by changing how Core handles the theme slug.
Version 7.1.1 escapes the theme slug before inserting it into the jQuery selector. Additionally, WordPress now limits the selector to genuine theme cards.
Administrators should install the latest WordPress release as soon as possible. The publication of complete technical details and exploit code increases the risk of attacks.
Websites that cannot update immediately can enable DISALLOW_FILE_MODS as a temporary defence. This setting prevents attackers from forcing the installation of a theme or malicious plugin.
However, upgrading remains the strongest protection against the WordPress Click2Shell flaw.
0 responses to “WordPress Click2Shell Flaw Enables PHP Execution”