A newly disclosed WordPress flaw can let attackers force-install a theme and chain the trick into arbitrary PHP execution on the server.
According to BleepingComputer, the vulnerability, dubbed Click2Shell, affects WordPress Core and exploits a cross-site request forgery weakness involving theme-preview URLs. Security researcher Paulos Yibelo of autonomous penetration-testing outfit pwn.ai discovered the problem and reported it to WordPress on 22 August.
The attack does not require the miscreant to have a WordPress account, administrative privileges or an installation nonce. There is a catch: a logged-in administrator has to visit a specially crafted URL. Once that happens, WordPress can be persuaded to install a theme from the official WordPress.org catalogue without the administrator explicitly hitting the Install button.
The problem comes from WordPress interpreting part of a theme-preview URL twice. The WordPress.org Themes API handles the value one way, while JavaScript running in the administrator’s browser processes it again using a buggy method. That discrepancy lets an attacker manipulate the browser into selecting and installing a chosen theme. WordPress helpfully supplies the administrator’s existing permissions, doing rather more of the attacker’s work than anyone would like.
Installing a theme does not by itself hand over the server. Yibelo demonstrated how Click2Shell could be chained with a separate vulnerability in an installed theme to execute attacker-controlled PHP code. An inactive theme can still have PHP loaded when WordPress generates a Customiser preview. The proof-of-concept used that behaviour to turn the forced installation into remote code execution.
Once arbitrary PHP is running, the attacker could gain access to more than the site’s collection of lovingly chosen fonts. The code could modify or delete files, access user information and read wp-config.php, which contains database credentials and authentication secrets.
That could be used to create rogue administrator accounts or inject malicious scripts into the site. WordPress patched the Core vulnerability in version 7.1.1 by escaping the theme slug before using it in the jQuery selector and limiting the selector to actual theme cards.
There is no CVE identifier for Click2Shell yet, and there is no evidence that the vulnerability has been exploited in real-world attacks. Unfortunately for anyone running an unpatched installation, technical details and working proof-of-concept code are now public.
Security outfit Patchstack said administrators unable to update immediately can reduce the risk if DISALLOW_FILE_MODS is enabled, since that prevents the forced installation of themes or plugins.
The less entertaining solution is simply to install WordPress 7.1.1 rather than waiting for someone on the internet to test the proof-of-concept against your server.
