"a value from a WordPress theme-preview URL is interpreted once by the WordPress.org Themes API and a second, buggy methods by JavaScript in the Administrator's browser."
Security researchers have published technical details and a proof-of-concept for a newly disclosed WordPress Core vulnerability, dubbed Click2Shell, that can be chained into pre-authenticated server-side remote code execution. The flaw was patched in WordPress 7.1.1; the underlying defect affected WordPress 7.1.0 and earlier and—critically—full technical details and a working PoC are already public.
How Click2Shell converts a theme preview into server-side PHP execution
Click2Shell is a multi-step chain that begins with a value in a theme-preview URL being interpreted twice: once by the WordPress.org Themes API and again by JavaScript running inside an administrator’s browser. That second interpretation is buggy and allows an attacker to cause a target site to add a theme from the official WordPress.org catalog without the administrator explicitly installing it.
Once the malicious or vulnerable theme is present, the WordPress Customizer’s preview mechanism can execute PHP from an inactive theme during preview rendering. The exploitation model described by the researcher separates two facts: an attacker does not need a WordPress account, a nonce, or their own administrative privileges to begin the attack, but the chain requires a logged-in administrator to visit a crafted URL in order for the browser-side step to fire and the installation/preview sequence to complete.
Proof-of-concept, disclosure timeline, and the researcher
The Click2Shell vulnerability was discovered by security researcher Paulos Yibelo of the autonomous penetration-testing platform pwn.ai, who reported it to WordPress on August 22. To demonstrate the technique, the researcher used a vulnerable WordPress theme as the second component in the chain to execute attacker-supplied PHP on the server. The researcher’s published technical report includes a complete proof-of-concept exploit for achieving server-side remote code execution.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadPotential consequences for compromised sites
According to the published analysis, code execution via Click2Shell could enable a range of damaging actions: modification or deletion of files, access to user data, retrieval of the wp-config.php file that contains database credentials and authentication secrets, creation of rogue administrative accounts, and injection of malicious scripts. While the demonstration used one particular theme, the Core flaw could be leveraged to force-install any other vulnerable theme from the WordPress.org catalog.
Patch details, mitigation, and short-term protections
WordPress addressed the Core issue in version 7.1.1. The fix escapes the theme slug before using it in the jQuery selector and restricts the selector to actual theme cards, preventing the double-interpretation that enabled the attack chain. The vulnerability does not have an official identifier, per the published material.
For administrators who cannot update immediately, Patchstack highlighted a configuration-based protection: sites with DISALLOW_FILE_MODS enabled cannot be forced to install the theme or a malicious plugin. Patchstack also emphasized that only an administrator account can trigger the chain—Author and Editor accounts lack the permission to install themes—and warned that attacks could be launched by targeted phishing or by exploiting an existing cross-site scripting (XSS) flaw to make an administrator’s browser send the crafted request. The researcher and Patchstack both recommend switching to the latest WordPress version given the public disclosure and PoC.
What this means for WordPress administrators, Patchstack, and attackers
- WordPress administrators: The immediate, concrete action reported is upgrading to WordPress 7.1.1. If an update cannot be applied immediately, the published guidance notes DISALLOW_FILE_MODS as a stopgap to block forced installations.
- Patchstack and security teams: Patchstack’s analysis narrows the attack surface to administrator accounts and calls out phishing and existing XSS as realistic delivery vectors; teams should therefore monitor for suspicious admin-session activity and alerts tied to theme-install operations.
- Attackers and exploit developers: With a full PoC available and the vulnerability rooted in Core behavior, the published record shows a clear pathway to force-installing any exploitable theme from the WordPress.org catalog, provided a logged-in administrator can be induced to visit a crafted URL.
Click2Shell is a concise example of how browser-side handling of seemingly benign values—the theme-preview slug—can be turned into server-side execution when combined with platform features such as theme installation and Customizer previews. With a public PoC and a working patch in 7.1.1, the immediate choices are straightforward: apply the Core update or, where that is not feasible, rely on DISALLOW_FILE_MODS while monitoring administrator sessions closely.
Original reporting: https://www.bleepingcomputer.com/news/security/wordpress-click2shell-flaw-lets-hackers-execute-php-on-the-server/
