Full Report
WordPress today released patches to fix a new set of vulnerabilities in its core software, one of which could allow a crafted web link, opened by a logged-in administrator, to install a theme from the official WordPress.org directory without anyone clicking Install. The security firm pwn.ai, whose researchers reported the flaw, calls the attack chain Click2Shell. On its own the flaw only
Analysis Summary
# Vulnerability: WordPress "Click2Shell" Forced Theme Installation
## CVE Details
- **CVE ID**: Pending (Assigned by WordPress, identifier not yet public)
- **CVSS Score**:
- **7.1 (High)**: Core vulnerability (Forced install only)
- **9.6 (Critical)**: Full attack chain (RCE via theme flaw combination)
- **CWE**: Not explicitly listed (Likely CWE-352: Cross-Site Request Forgery or CWE-20: Improper Input Validation)
## Affected Systems
- **Products**: WordPress Core
- **Versions**: Version 6.0 up to (but not including) 7.1.1.
- **Configurations**: Requires a logged-in Administrator to visit a malicious link.
## Vulnerability Description
The "Click2Shell" vulnerability arises from a discrepancy in how WordPress.org and the WordPress core software interpret specific characters in a URL.
1. **Differential Parsing**: An attacker crafts a link containing a legitimate theme name appended with specific punctuation/characters.
2. **Execution**: When an administrator clicks the link, the WordPress.org directory ignores the extra characters and returns a valid theme. However, the administrator’s browser interprets those same characters as instructions to interact with the "Install" button on the local WordPress dashboard.
3. **Session Reuse**: Because the administrator is authenticated, the browser automatically supplies the necessary security tokens (nonces) and permissions, triggering the installation and preview of the theme without user interaction beyond the initial click.
## Exploitation
- **Status**: PoC available (demonstrated by pwn.ai researchers); No evidence of exploitation in the wild.
- **Complexity**: Medium (Requires a logged-in administrator to click a link).
- **Attack Vector**: Network (Web/Link-based).
## Impact
- **Confidentiality**: High (If chained to RCE).
- **Integrity**: High (Ability to modify site themes and execute arbitrary code).
- **Availability**: High (Potential for server takeover).
## Remediation
### Patches
- **WordPress 7.1.1**: Primary security release.
- **Legacy Branches**: Security updates have been backported to all supported versions from **4.7** through **7.1**. Site owners should ensure their version is updated to the latest minor release in their respective branch.
### Workarounds
- No official workarounds provided other than patching.
- Administrators should practice caution and avoid clicking suspicious links while authenticated to their WordPress dashboard.
## Detection
- **Indicators of Compromise**:
- Presence of unexpected themes installed but not activated (specifically themes from the official directory like "Mobile Repair Zone").
- Reviewing web server access logs for unusual parameters in `wp-admin` URLs related to theme installations.
- **Detection methods**:
- Regular integrity checks of the `wp-content/themes` directory.
- Monitoring for administrative actions performed via external referrers.
## References
- **Vendor Advisory**: hxxps[://]wordpress[.]org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/
- **Research Blog**: hxxps[://]pwn[.]ai/blog/click2shell
- **Documentation**: hxxps[://]wordpress[.]org/documentation/wordpress-version/version-7-1-1/