A specially crafted WordPress link can trick a logged-in administrator’s browser into installing an attacker-selected theme, creating a path to server-side PHP execution when chained with a separate flaw in that theme, security researchers at pwn.ai have found.
Researcher Paulos Yibelo of autonomous penetration-testing platform pwn.ai discovered the issue, dubbed Click2Shell, and reported the underlying WordPress Core vulnerability on August 22. WordPress reproduced the behaviour the same day and fixed the Core flaw in WordPress 7.1.1, released September 17.
How the Attack Starts
Click2Shell begins with WordPress’ theme-preview functionality. A specially crafted value passed through the theme installer can cause WordPress to install a theme from the official WordPress.org catalog, without the administrator ever clicking Install.
The attacker doesn’t need a WordPress account, an installation nonce or admin privileges. The one requirement is that a logged-in administrator visits the crafted link.
One value, two interpretations. The vulnerability exists because WordPress processes the theme value inconsistently. The WordPress.org Themes API applies standard slug canonicalization, reducing the input to a valid theme slug. The administrator’s browser, however, keeps the original characters and inserts them into a jQuery selector.
According to pwn.ai, this mismatch lets an attacker manipulate the selector so it reaches the Install button inside the returned theme card. WordPress’ own JavaScript then triggers the click automatically, forcing a theme install the administrator never asked for.
The researchers demonstrated this using the Twenty Twenty theme. Because the theme stays inactive, the site’s visible appearance never changes, which raised the next question: could an inactive theme still execute PHP?
From Installation to Code Execution
The answer was yes. The researchers found that WordPress loads an inactive theme’s PHP while preparing a Customizer preview, providing the second stage of the chain.
During their research, pwn.ai also found a separate vulnerability in the Mobile Repair Zone 2.5.4 theme, which registered an AJAX handler without any nonce or capability check. That handler accepted attacker-controlled plugin details, including a plugin package URL and main file, then fetched the package, wrote it into the plugins directory, unpacked it and loaded its PHP.
The researchers found more than 40 third-party WordPress.org themes with the same type of unprotected endpoint.
Putting the chain together:
- A crafted theme-installer link forces WordPress to install a catalog theme.
- The Customizer loads the inactive theme’s PHP.
- This exposes the vulnerable AJAX handler.
- The handler writes an attacker-selected plugin package to the site.
- The plugin’s PHP executes under the WordPress server account.
For their proof of concept, the researchers used a harmless plugin whose PHP simply returned the output of system(“id”). In practice, they noted, arbitrary PHP execution could let an attacker read wp-config.php and database credentials, access WordPress and plugin data, create or modify users and content, read secrets available to the PHP worker, alter application files, and potentially take over the site or its host server.
The Fix
WordPress patched the Core vulnerability in version 7.1.1, restricting the jQuery selector to match only an actual theme card and escaping the URL-derived theme slug before it reaches selector syntax.
The Core issue affects all WordPress versions before 7.1.1. WordPress paid pwn.ai its maximum bug bounty of $300 for the report. At the time of technical disclosure, no CVE identifier had been assigned, though WordPress said one was in progress.
Disclosure timeline:
- Aug. 22: Initial Core vulnerability reported
- Sept. 1: Full pre-activation chain provided to WordPress
- Sept. 17: WordPress 7.1.1 released with the fix
- Sept. 18: Click2Shell publicly disclosed
The researchers describe Click2Shell as a remote code execution chain that requires no attacker account, but depends on tricking a logged-in administrator into visiting a single crafted link. Combined with a vulnerable theme, it opens a direct path to attacker-controlled PHP execution on the server.
