WordPress has recently rolled out updates to address 11 vulnerabilities, including a critical flaw known as ‘Click2Shell’ that could potentially lead to remote code execution (RCE). This vulnerability, though currently lacking a CVE identifier, has been detailed in a recent advisory from WordPress.
Exploitation Pathway of Click2Shell
The Click2Shell vulnerability can be exploited through specially crafted URLs designed to automatically install and preview inactive themes within WordPress. Despite appearing innocuous, this flaw poses significant risks, as noted by cybersecurity firm pwn.ai, responsible for identifying and reporting the issue.
The vulnerability arises because a value embedded in the WordPress theme-preview URL is processed differently by the theme API compared to the JavaScript in an administrator’s browser. According to pwn.ai, this discrepancy leads the API to convert the value to a standard theme slug, while the browser retains the original syntax within a jQuery selector.
Potential Risks and Exploits
This discrepancy permits unauthorized attackers to install a theme of their choosing on an administrator’s site without consent. These themes, fetched from the official WordPress.org repository, can then be exploited for RCE. pwn.ai discovered that over 40 third-party themes could be misused for executing PHP code, even while inactive.
During the Customizer preview process, WordPress loads PHP code from inactive themes, potentially allowing attackers to utilize vulnerable installers to direct the system towards a malicious plugin package. This exploit requires no attacker account; a single visit from a logged-in user is sufficient to compromise the site.
WordPress’s Response and Future Updates
To mitigate these risks, WordPress released patches in version 7.1.1, addressing Click2Shell and 10 other vulnerabilities. The update extends back to WordPress versions 4.7, ensuring broader protection. As a token of appreciation, WordPress awarded pwn.ai with a $300 bug bounty, the maximum reward offered.
The recent updates are crucial for maintaining website security, especially as administrators may overlook suspicious activities due to the continued operation of the main theme during exploitation attempts.
Website owners and administrators are strongly advised to update their WordPress installations immediately to safeguard against these vulnerabilities and prevent potential security breaches.
