WordPress has fixed a security flaw that could allow a specially crafted link to install and preview a theme from the official WordPress.org directory without an administrator intentionally choosing to install it.
The vulnerability, named Click2Shell by researchers at pwn.ai, was fixed in WordPress 7.1.1, released September 17 as part of a maintenance and security update containing 11 security fixes.
On its own, the flaw could force the installation of an attacker-selected theme from the official WordPress.org catalog. Researchers also demonstrated that it could be combined with a separate vulnerability in a theme to run PHP code on the affected website.
The issue involved WordPress’s theme preview feature. According to pwn.ai, an attacker could create a specially crafted theme-preview link that caused WordPress to automatically trigger its own Install control when opened by a logged-in administrator.
The administrator did not need to manually choose Install or Activate. WordPress would download the selected theme from its official theme directory and place it on the site while leaving the current theme active.
Installing the theme alone did not give an attacker control of the site.
Researchers took the attack further by combining the WordPress flaw with a separate vulnerability in version 2.5.4 of the Mobile Repair Zone theme. WordPress could load code from that inactive theme during a preview, exposing a vulnerable function that could then be used to install and run additional PHP code.
The demonstrated attack required a logged-in WordPress administrator to visit the crafted link, but the attacker did not need an account on the targeted site.
WordPress Changed How Theme Preview Links Are Handled
WordPress changed how the theme preview page processes information from a URL so that specially crafted characters can no longer be interpreted in a way that triggers the installation process.
Pwn.ai rated the standalone forced-theme-installation issue High severity. The researchers said the demonstrated code-execution chain depended on an additional vulnerable theme and interaction from a logged-in administrator.
At the time of the technical disclosure, the issue did not yet have a public CVE identifier.
Researchers expect the core issue to affect WordPress versions released before 7.1.1. Site owners should therefore make sure they are running WordPress 7.1.1 or later, or the corresponding security release for a supported older branch.
Leave a Reply