WordPress released 7.1.1 on 17 September to fix a set of core vulnerabilities, one of which lets a crafted web link opened by a logged-in administrator install a theme from the official WordPress.org directory without anyone clicking Install. The reporting firm, pwn.ai, calls the chain Click2Shell. The mechanism is a parser differential: the WordPress.org directory reads the value in the link as an ordinary theme name and returns a real theme, while the administrator's browser reuses the original text — punctuation included — inside code that selects an item on the page, and attacker-added characters steer it to the Install button. Because the administrator is already authenticated, their session supplies both the capability and the security token; the attacker supplies neither. The installed theme stays inactive, so the site looks unchanged, and reaching code execution required a second flaw in the theme pwn.ai used (Mobile Repair Zone), whose background handler fetched and executed a package without checking permissions or a nonce. There is no sign of exploitation in the wild.

• Source article