WordPress has rolled out urgent patches to address a newly discovered set of vulnerabilities in its core software. Among these, a significant flaw could enable a specially crafted web link, when opened by a logged-in administrator, to silently install a theme from the official **WordPress.org** directory without explicit user interaction. ### Unpacking 'Click2Shell' Security firm **pwn.ai**, responsible for reporting this vulnerability, has named the attack chain **Click2Shell**. While the core flaw alone only installs a legitimate theme chosen by the attacker, **pwn.ai** researchers demonstrated its potential when combined with a separate weakness in the installed theme. This combination could allow an attacker to execute their own code on the server.  ### The Mechanism of Attack The vulnerability exploits a discrepancy in how two parts of **WordPress** interpret the same link. The **WordPress.org** directory reads the link's value as a standard theme name, returning a real theme. However, the administrator's browser reuses the original text, including punctuation, within code designed to select an item on the page. Attackers can inject characters into the link to manipulate this code, effectively triggering the 'Install' button via **WordPress**'s own scripts. Crucially, because the administrator is already logged in, their active session provides the necessary permissions and security tokens for the installation, circumventing the need for the attacker to supply them. The installed theme remains inactive, preventing immediate visual changes to the website. ### Chaining for Remote Code Execution The true danger of **Click2Shell** emerges when it's chained with a secondary vulnerability. **pwn.ai** demonstrated this by using a theme named **Mobile Repair Zone**, which contained a flaw: a background handler that fetched a web address, downloaded a package, and executed its code without proper permission checks or security tokens. When this vulnerable theme was force-installed, its handler executed the attacker's code on the server.  ### Severity and Remediation **pwn.ai** rated the forced-install flaw alone as high severity, with a **CVSS** score of 7.1. The full chain to code execution was classified as critical, scoring 9.6. While **WordPress** has not published its own **CVSS** rating, it described the issue as: "Specially crafted URLs can automatically install and preview an inactive theme from **WordPress.org**." A **CVE** identifier is expected to be assigned soon. ### Immediate Action Required **WordPress** addressed this vulnerability in its **7.1.1** security release, which shipped on September 17th. Fixes extend to supported branches back to version 4.7. Site owners are strongly advised to update to **WordPress 7.1.1** or the corresponding update for their specific branch immediately. Sites configured for automatic updates should receive the patch on their own. It's important to note that no separate workaround has been offered by either **WordPress** or **pwn.ai**. The attack still requires a logged-in administrator to open the malicious link. Updating the **WordPress** core effectively mitigates the demonstrated attack chain, regardless of the themes a site uses. This isn't **pwn.ai**'s first **WordPress** core discovery in recent weeks. In August, **WordPress** patched a similar pre-authentication **XSS** flaw found by **pwn.ai** in the login screen, which could also be chained to code execution. This **Click2Shell** flaw is distinct from the "wp2shell" vulnerability disclosed in July, which did not require a login or click and has been actively exploited in the wild.