WordPress Core CSRF bug enables remote code execution via theme preview
A newly disclosed WordPress Core vulnerability, dubbed Click2Shell, allows unauthenticated attackers to chain a cross-site request forgery flaw with a theme-preview mechanism to execute arbitrary PHP code on affected servers. The attack requires a logged-in administrator to visit a crafted URL, after which a malicious theme can be force-installed and its code run during a Customizer preview. The issue, patched in WordPress 7.1.1, could lead to file tampering, credential theft, and creation of rogue admin accounts.
The vulnerability chain works by exploiting how a theme-preview URL is interpreted differently by the Themes API and by browser-side JavaScript. An attacker can inject a theme from the WordPress.org catalog without admin consent, and the Customizer preview executes that theme's PHP code even when the theme is inactive. The researcher's proof-of-concept demonstrates full server-side code execution.
WordPress addressed the flaw in version 7.1.1 by escaping the theme slug before it reaches the jQuery selector and restricting the selector to legitimate theme cards. For sites that cannot update immediately, enabling the DISALLOW_FILE_MODS constant blocks forced theme installation. The public availability of technical details and a working exploit increases urgency for administrators to patch.
The Click2Shell vulnerability could affect a vast number of WordPress-powered websites, given the platform's widespread adoption. Site administrators may face significant disruption if exploited, including data breaches, defacement, or complete server compromise. Because the attack requires an administrator to click a crafted link, phishing campaigns and social engineering become the primary delivery vectors. Organizations relying on WordPress for business operations could experience downtime, reputational damage, and regulatory consequences from compromised user data. Smaller sites with limited security resources may be particularly vulnerable, as timely patching and monitoring may not be prioritized.