WordPress has issued a patch to repair vulnerabilities in its core software, including a significant flaw known as Click2Shell. This vulnerability allows a crafted web link to install a theme from WordPress.org without the need for user interaction, provided it is opened by a logged-in administrator.
Understanding the Click2Shell Flaw
The flaw, discovered by security researchers at pwn.ai, can install a legitimate theme chosen by an attacker. However, when combined with another vulnerability within that theme, it could potentially allow the execution of malicious code on the server. WordPress released a fix on September 17, as part of version 7.1.1, urging users to update immediately. There is no evidence of this flaw being exploited in real-world scenarios yet.
Technical Details and Potential Impact
The vulnerability arises because two components of WordPress interpret the same link differently. While the WordPress.org directory sees it as a regular theme name, the administrator’s browser retains the original format, which could trigger an unwanted installation process. The attack leverages the fact that a logged-in administrator’s session provides the necessary permissions for installation without further authorization.
Though the theme remains inactive post-installation, WordPress’s Customizer tool can still load its PHP code. This was exemplified by pwn.ai using a theme with a secondary flaw that executed code from an external source without proper authorization checks.
Recommendations and Future Outlook
The Click2Shell vulnerability has been rated with a high severity score on its own and as critical when the full exploit chain is considered. WordPress has not yet published its own severity assessment, but it has acknowledged the risk, explaining the issue as URLs capable of installing and previewing inactive themes. Users are encouraged to install version 7.1.1 or the equivalent update for their branch to mitigate this vulnerability.
For those unable to update immediately, it is important to note that the attack requires an administrator to open the malicious link. As such, no workaround has been suggested by WordPress or pwn.ai. Updating the WordPress core is the recommended solution to prevent potential exploitation.
Recent Security Challenges in WordPress
This is not the first time WordPress has had to address significant security vulnerabilities. In August, a similar flaw was patched, which involved the login screen and was also linked to potential code execution. Another separate vulnerability, identified in July, called wp2shell, does not require login credentials or user interaction and has been recognized by U.S. cybersecurity authorities as actively exploited.
Staying updated with the latest patches and understanding the nature of these vulnerabilities is crucial for WordPress site owners to maintain robust security and protect against potential threats.
