WordPress Click2Shell flaw lets attackers execute PHP

Researchers published technical details and a proof-of-concept for Click2Shell, a WordPress Core cross-site request forgery chain. WordPress had already released version 7.1.1 to address the problem, and the issue had no official identifier.

Paulos Yibelo of pwn.ai found the flaw and sent it to WordPress on 22 August. The chain could let an attacker add a theme from the WordPress.org catalogue and then run PHP code on the server.

The researchers said a value from a theme preview link was handled twice, first by the WordPress.org Themes API and then by browser JavaScript in an administrator session. In their example, the attack still needed a logged-in administrator to open the crafted link.

Patchstack reviewed the issue and said only an administrator could trigger the sequence, while Author and Editor accounts did not have the needed permission to install themes. It also said delivery could come through targeted phishing or through another cross-site scripting flaw that made the browser send the request.

WordPress said the fix in 7.1.1 escaped the theme slug before it reached the selector and limited the selector to real theme cards. The article also said sites with DISALLOW_FILE_MODS enabled could not be forced to install a theme or a malicious plugin.