WordPress Click2Shell Vulnerability Enables Pre‑Authenticated Remote Code Execution via Theme Installation
What Happened – A new cross‑site request forgery (CSRF) flaw in WordPress Core, dubbed Click2Shell, allows an unauthenticated attacker to force‑install any theme from the official catalog and execute arbitrary PHP on the server. The chain requires a logged‑in administrator to visit a crafted URL, after which the theme’s PHP runs in the Customizer preview, giving the attacker full server‑side control. WordPress released version 7.1.1 to remediate the issue.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of insufficient validation of privileged actions – a control‑area that continuous‑monitoring programs must evidence (e.g., “admin‑only actions are logged and approved”).
- Highlights the need for real‑time patch‑status evidence; without it, organizations cannot prove they meet change‑management objectives across frameworks.
- Shows that a single vulnerable component can expose credentials (wp‑config.php) and user data, underscoring the importance of documented remediation workflows.
Who Is Affected – SaaS platforms, managed WordPress hosting providers, and any organization that runs self‑hosted WordPress sites (e‑commerce, media, education, NGOs).
Recommended Actions
- Upgrade all WordPress installations to 7.1.1 or later immediately.
- Enforce least‑privilege for admin accounts; restrict theme installation to a vetted list.
- Deploy a Web Application Firewall that blocks unauthorized theme‑install requests.
- Integrate theme‑install and Customizer‑preview events into your SIEM for continuous evidence collection.
Source: BleepingComputer
Technical Notes – The exploit leverages a CSRF chain: a crafted URL triggers the Themes API, which then injects a malicious theme preview script that runs PHP on the server. No authentication or nonce is required, but a logged‑in admin must load the URL. The vulnerability was disclosed without a CVE identifier; WordPress 7.1.1 contains the fix.
Source: same as above