Click2Shell: One Link Can Hijack a WordPress Site
A single link in an attacker’s hands can make WordPress install a theme without a button being pressed, provided an already-authenticated administrator opens it. On September 17, WordPress released version 7.1.1, which closes a flaw in the CMS core. The pwn.ai team has shown that, combined with a separate vulnerability in a theme, the Click2Shell chain reaches the execution of PHP code on the server. WordPress detailed the patch in its 7.1.1 maintenance and security release announcement.
Forced Theme Installation From the Official Catalog
The specialists described the core flaw as a forced installation of a theme from the official WordPress.org directory. The vulnerability by itself does not allow the upload of an arbitrary ZIP archive. The attacker selects an existing theme, after which WordPress downloads it in the standard way. pwn.ai rates this stage at 7.1 on CVSS 3.1, and the full chain to RCE at 9.3. The researchers laid out the technique in their Click2Shell analysis.
The problem arises because the server and the browser parse the same theme parameter differently. The WordPress catalog API normalizes the value and obtains an ordinary theme name, while the JavaScript in the admin panel preserves the original characters and places the string into a jQuery selector. Special characters allow the selector to be altered so that the standard code itself presses the real Install button.
No Confirmation Needed From the Administrator
The administrator does not have to confirm the installation. The active session already contains the install_themes right and a protective nonce, so the victim’s browser passes WordPress everything necessary on the user’s behalf. The attacker needs no account on the site, but requires that the administrator be logged in and open the prepared link or a page containing such a link.
The installed theme remains inactive, so the site’s appearance does not change and no noticeable signal may reach the owner. However, WordPress, during a preview through the Customizer, can load the PHP code of a not-yet-activated theme. It is precisely this mechanism that turns the hidden installation from a standalone problem into the basis for a further chain.
From Hidden Install to a Working Shell
For the demonstration, pwn.ai used Mobile Repair Zone 2.5.4. The theme ran an AJAX handler that accepted the address of a plugin package, downloaded the archive, unpacked it, and included a PHP file without any nonce check or required privileges. After the forced theme installation, the Customizer loaded its code, and a second request allowed the attacker’s chosen PHP to run under the web server’s account.
The full chain grants capabilities characteristic of a WordPress takeover: reading wp-config.php and database credentials, access to plugin and WooCommerce data, altering users and content, reading PHP-process secrets, and editing application files. pwn.ai stresses that such consequences are shown in a test demonstration and do not describe a confirmed attack campaign.
How WordPress Fixed It
WordPress developers fixed the very source of the problem in the theme-installer JavaScript. The code now confines its search to the div.theme card and escapes the theme name obtained from the URL through escapeSelector(). As a result, quotation marks, combinators, and other control characters cease to alter the structure of the CSS selector and can no longer steer it to the install button.
WordPress 7.1.1 includes 11 security fixes besides the usual core and block-editor fixes. The project recommends updating sites immediately, and for supported older branches it released separate versions with fixes going all the way back to the 4.7 line. On sites with automatic background updates, installation should start automatically, but the version is worth checking manually.
Timeline and Context
For Click2Shell, no CVE had been assigned at the time of publication, and WordPress had not yet published its own final severity assessment. pwn.ai reported the flaw on August 22, handed over the full chain on September 1, and disclosed the technical details on September 18 after the fix’s release. In open sources, there is as yet no public data on the use of Click2Shell in real-world attacks.
The new chain continues a series of findings in the WordPress core. In August, pwn.ai already showed XSS2Shell, where a flaw on the login page, under additional conditions, likewise led to the execution of PHP code. Click2Shell uses a different mechanism, and the attack requires an authenticated administrator who opens a prepared resource during an active session on the site.
Click2Shell is not connected to the July wp2shell chain, although both problems lay in the WordPress core and could end in code execution. In the case of wp2shell, attackers seized unupdated sites without any account or administrator action, and CISA lists it as exploited in real attacks. For Click2Shell, as of September 18, no such activity has been publicly confirmed.
What Site Owners Should Do
WordPress and pwn.ai offered no separate workaround. Site owners are advised to install WordPress 7.1.1 or the corresponding release for their branch and to ensure the update was actually applied. Such a step closes the core flaw regardless of the installed theme and breaks the demonstrated chain at its very first stage.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
