WordPress Patches Click2Shell Flaw that Forces Theme Installs

WordPress has released an emergency security update to address a significant vulnerability labeled Click2Shell. The flaw allows an attacker to craft a malicious web link that, when opened by a logged-in administrator, automatically installs a theme from the official directory. This happens without the administrator explicitly clicking an install button, effectively bypassing a key safety step in the site management process.

Security firm pwn.ai, which reported the issue, demonstrated that this forced installation can be combined with a separate weakness in specific themes to execute arbitrary code on the server. While the core flaw alone only installs a legitimate theme from WordPress.org, the chained attack allows for full control of the website. The fix was released on September 17 as part of version 7.1.1, and administrators are urged to update immediately to close this gap.

How the forced installation works

The vulnerability exploits a discrepancy in how WordPress handles data from the official theme directory versus how the administrator's browser processes it. When an attacker includes specific characters in a link, the browser reuses this text in the page’s underlying code. This manipulation causes WordPress’s own script to automatically trigger the install function. Because the administrator is already logged in, their session provides the necessary permissions and security tokens, meaning the attacker does not need to steal credentials.

The installed theme remains inactive, so the website’s appearance does not change, and no visible alert is triggered. This stealthy nature makes the attack difficult to detect through routine visual checks. The core bug does not allow the installation of arbitrary files directly; instead, it forces the selection of a real theme from the official repository, which is then used as a vehicle for the next stage of the attack.

Chaining flaws for code execution

To achieve code execution, the researchers utilized a secondary flaw in a theme called Mobile Repair Zone. This theme contained a background handler that fetched a web address, downloaded a package, and executed its code without verifying the visitor’s permissions. When WordPress builds a preview in its customization tool, it can load a theme’s code even before the theme is officially activated. By chaining the forced install with this specific theme flaw, the attacker’s code runs on the server.

The severity of this combined attack is rated as critical, with a CVSS score of 9.6. The forced-install flaw alone is considered high severity, scoring 7.1. Although WordPress described the issue narrowly in its release notes, emphasizing the automatic installation aspect, the potential for total compromise via chaining is the primary concern for site owners. No CVE identifier has been assigned yet, but one is expected.

Updating to close the gap

The fix is included in WordPress 7.1.1, with backports available for supported versions ranging from 4.7 up to the release preceding the patch. The vulnerability affects versions 6.0 and later. Site owners should install the latest update immediately. Those configured for automatic updates will receive the patch without manual intervention. As reported by The Hacker News, there is currently no evidence that this specific flaw has been exploited in the wild, unlike other recent vulnerabilities.

No separate workaround exists for this issue, so updating the core software is the only reliable defense. While the attack requires a logged-in administrator to click a malicious link, which reduces the risk compared to vulnerabilities that require no interaction, the potential impact remains severe. Administrators should also review their installed themes for similar unchecked handlers to prevent other potential attack vectors.