Particle.news
Get it on Google Play
Download on the App Store
3 ARTICLES
·
15h ago

WordPress Fixes Click2Shell Flaw That Could Let Admin Click Trigger Server RCE

A public proof-of-concept raises urgent risk for unpatched sites because a logged-in administrator need only visit a crafted link to trigger server-side code execution.

Overview

  • WordPress released fixes in version 7.1.1 and applied the correction to older branches to close a theme-preview parsing bug in Core.
  • Researcher Paulos Yibelo of pwn.ai reported that the bug lets an attacker force-install a theme from the official catalog and have an administrator’s browser load that theme’s PHP during a Customizer preview.
  • The chain can produce pre-authenticated remote code execution on the web server because an attacker does not need an account and only needs a logged-in admin to open a crafted URL.
  • pwn.ai published a full technical report and proof-of-concept and identified more than 40 third-party themes that could be abused, so security firms urge immediate updates and short-term mitigations such as enabling DISALLOW_FILE_MODS.
  • Successful exploitation can expose wp-config.php and database credentials, modify files or create rogue admin accounts, and WordPress paid pwn.ai a $300 bug-bounty for the report.