Researchers have disclosed a WordPress exploit chain known as Click2Shell, which was addressed in WordPress 7.1.1 as part of a security release containing 11 fixes. When combined with vulnerabilities in affected themes, the attack can lead to remote code execution (RCE) and full site compromise. Protect you and your clients’ environments now.
What is the threat?
Click2Shell is a WordPress Core vulnerability that abuses how WordPress handles theme installation and preview requests. An attacker can trick a logged-in administrator into visiting a specially crafted URL. WordPress then processes the request using the administrator’s permissions, allowing a theme from the WordPress.org theme repository to be installed without the administrator intentionally initiating the action.
On its own, the vulnerability results in unauthorized theme installation. However, because WordPress may load an inactive theme’s PHP code during a Customizer preview, attackers can potentially reach vulnerable theme functionality without activating the theme. Researchers demonstrated that if a vulnerable theme is installed, attackers may be able to leverage weaknesses in that theme to install malicious plugins, execute PHP code, deploy web shells, or gain control of the WordPress application.
A notable aspect of the attack is that the site’s visible theme may never change, making the compromise more difficult for administrators to detect.
Why is it noteworthy?
This vulnerability affects WordPress Core, not just a specific plugin or theme. The attack also challenges the assumption that inactive themes are harmless. A theme does not necessarily need to be activated for its code to become reachable during a preview process. When combined with vulnerable third-party themes, Click2Shell creates a practical path from social engineering to server-side code execution.
Because newly installed themes and plugins may remain largely invisible to administrators, successful compromise could go undetected for an extended period.
What is the exposure or risk?
Organizations running unpatched WordPress installations may be vulnerable if a logged-in administrator visits a malicious link.
Successful exploitation can result in:
- Unauthorized theme or plugin installation
- Remote code execution
- Web shell deployment
- Credential theft
- Data manipulation
- Persistent access
- Website defacement
- Malware hosting or phishing activity
- Full compromise of the WordPress application
Risk increases when administrators browse email or external websites while logged into WordPress, or when environments allow theme and plugin modifications through the WordPress dashboard.
What are the recommendations?
Barracuda recommends the following actions to reduce risk:
Update WordPress
- Upgrade WordPress Core to version 7.1.1 or later.
- Apply security updates for supported branches if an immediate upgrade is not possible.
Update themes and plugins
- Patch all installed themes, including inactive themes.
- Remove unsupported or abandoned plugins.
- Review environments for themes referenced in published research, including Mobile Repair Zone 2.5.4.
Remove unused themes
- Delete unnecessary inactive themes.
- Retain only active themes and required fallback themes.
- Monitor for unexpected additions under
wp-content/themes/.
Restrict administrative access
- Limit WordPress administrator privileges to required personnel.
- Enable MFA for administrator accounts.
- Avoid using administrator sessions for routine browsing.
Harden file modification controls
- Disable direct theme and plugin editing where possible.
- Restrict write permissions to required directories.
- Consider disabling plugin and theme installation in production environments.
Monitor for suspicious activity
Review logs for unexpected access to:
/wp-admin/theme-install.php/wp-admin/admin-ajax.php- Customizer-related requests
Investigate:
- New themes or plugins
- Unexpected PHP files
- Recently modified theme files
Reduce social engineering risk
- Train administrators to avoid clicking unsolicited links while logged into WordPress.
- Use separate browser profiles for administration activities.
- Require reauthentication for sensitive actions where possible.
Use WAF and virtual patching
- Deploy rules that identify suspicious theme-installation activity.
- Block requests containing abnormal theme parameters or selector manipulation attempts.
Investigate potential exposure
If systems were unpatched:
- Review for unexpected themes or plugins.
- Examine administrative and web server logs.
- Rotate administrator credentials and revoke active sessions if compromise is suspected.
References
For more in-depth information about the recommendations, please visit the following links:
If you have any questions about this Cybersecurity Threat Advisory, don’t hesitate to get in touch with Barracuda Managed XDR’s Security Operations Center.
