Security researchers have unveiled a critical cross-site request forgery (CSRF) vulnerability in **WordPress Core**, now publicly known as 'Click2Shell.' This exploit chain facilitates pre-authenticated remote code execution (RCE), allowing an attacker to install any theme from the official **WordPress.org** catalog and execute arbitrary PHP files on a target server. ### The Discovery and Patch The 'Click2Shell' vulnerability, which currently lacks an official **CVE** identifier, was reported to **WordPress** on August 22 by security researcher **Paulos Yibelo** of the autonomous penetration testing platform **pwn.ai**. **WordPress** swiftly addressed the issue with the release of **WordPress version 7.1.1** last week. ### How Click2Shell Works **Yibelo**'s research details a two-stage exploit. The flaw leverages how a value from a theme-preview URL is interpreted first by the **WordPress.org** Themes API and then by a buggy JavaScript method within the administrator's browser. This allows an attacker to surreptitiously add a **WordPress** theme to a target website without explicit administrator action. Crucially, even an inactive theme can execute PHP code during a Customizer preview. The attack chain begins with a specially crafted URL. If a logged-in administrator visits this URL, it triggers the installation of a vulnerable theme. Once the Customizer preview loads this inactive theme's PHP, the malicious code is executed on the server. ### Impact of Exploitation Successful exploitation of 'Click2Shell' could grant attackers significant control over the compromised **WordPress** site. This includes the ability to modify or delete files, access sensitive user data, and even retrieve the `wp-config.php` file, which contains crucial database credentials and authentication secrets. Such access could be leveraged to create rogue administrator accounts or inject persistent malicious scripts. While **Yibelo** demonstrated the flaw using a specific vulnerable theme, the underlying vulnerability in **WordPress Core 7.1.0** and earlier versions could theoretically be used to force-install any other vulnerable theme found in the **WordPress** catalog. ### Attack Prerequisites and Mitigation An attacker does not need a **WordPress** account, an installation nonce, or their own administrative privileges to initiate a 'Click2Shell' attack. However, a key prerequisite is that a logged-in administrator must visit the crafted malicious link. **WordPress** security firm **Patchstack** analyzed the 'Click2Shell' vulnerability, emphasizing that only an administrator account possesses the necessary permissions to trigger the theme installation chain. Author and Editor accounts are not affected. **Patchstack** warned that attacks could be executed via targeted phishing campaigns or by chaining the exploit with an existing cross-site scripting (XSS) flaw. **WordPress** patched the vulnerability in version 7.1.1 by properly escaping the theme slug before its use in the **jQuery** selector and restricting the selector to actual theme cards. For administrators unable to update immediately, **Patchstack** notes that enabling `DISALLOW_FILE_MODS` can prevent forced theme or plugin installations. Nevertheless, given the public availability of technical details and a proof-of-concept exploit, immediate updating to **WordPress version 7.1.1** or newer is the strongest recommendation.