Install WordPress 7.1.1. One crafted link, opened by an already signed-in administrator, pulls a genuine theme from the official WordPress.org directory onto the site with nobody pressing Install.
pwn.ai’s researchers found and reported it, and they call the chain Click2Shell. Alone it forces a theme, rated 7.1. With the second weakness that lived in that theme, the path reaches code execution at 9.6. The patch appeared on September 17, in a security release that also covers supported branches back to 4.7.
One link, two readings
A parsing mismatch sits underneath. On the WordPress.org side the value inside the link is read as nothing more than a theme name, and a genuine theme comes back. On the browser side that same string, punctuation included, is handed to code that selects an element on the page. A few extra characters aim the selector at the Install button; the click comes from WordPress’s own JavaScript. The attacker supplies no credentials, since the signed-in session already holds the permission and the security token.
The theme sits inactive until switched on, so the site’s look never shifts and nothing gives it away. The second flaw lived in Mobile Repair Zone, pwn.ai’s theme: a background handler that checked neither permission nor token. It accepted a web address passed in the request, fetched the package it named, and executed it. Running code on the server was the handler’s doing, not the install’s.
No CVE identifier exists yet, though pwn.ai says one is planned. Nothing suggests anyone used it in the wild. The affected range runs 6.0 through the versions just before the fix. Automatic updates deliver 7.1.1 unaided. Where an update has to wait, neither party published a workaround, and an administrator still opens the link. Whatever theme a site runs, updating core closes the demonstrated path.
