The Click2Shell vulnerability in WordPress arises from inconsistent interpretation of a value in the theme-preview URL by the themes API and the JavaScript running in an administrator's browser. The API reduces the value to a standard theme slug, while the browser retains original punctuation and uses it in a jQuery selector. This discrepancy allows an unauthenticated attacker to install an attacker-chosen inactive theme from the official WordPress.org catalog without administrator knowledge. Although inactive themes normally pose limited risk, over 40 third-party themes were identified that could be abused for PHP code execution during the Customizer preview, which loads PHP code of inactive themes. This enables remote code execution under the WordPress server account with just a single visit from a logged-in user, without requiring an attacker WordPress account. WordPress released patches in version 7.1.1 and backported fixes to versions back to 4.7. The vulnerability was responsibly disclosed by pwn.ai, who also published technical details and proof-of-concept code.

Successful exploitation allows an unauthenticated attacker to force installation of an attacker-selected inactive theme, which can be leveraged to execute arbitrary PHP code on the WordPress server during theme preview. This leads to remote code execution with the privileges of the WordPress server process. The attack requires only a single visit from a logged-in user and does not require the attacker to have a WordPress account. The administrator may not notice the exploit since the active theme remains unchanged during the attack.

WordPress has released an official patch for the Click2Shell vulnerability in version 7.1.1 and backported fixes to all supported versions back to 4.7. Site administrators should upgrade to WordPress 7.1.1 or later, or apply the corresponding security updates for their WordPress version. No additional mitigation actions are required beyond applying the official patches.