WordPress fixes critical flaw that lets hackers install malicious themes

WordPress has patched a serious security hole that lets attackers force-install malicious themes on your site, according to BleepingComputer. The flaw, dubbed ‘Click2Shell,’ allows code execution without admin credentials, though it does require a logged-in administrator to click a specific link. Security researcher Paulos Yibelo of pwn.ai discovered the issue and reported it last week.

The vulnerability affects WordPress Core version 7.1.0 and earlier. It works by tricking the browser into installing a theme from the official catalog. Even if that theme is inactive, its code can run on the server when a preview loads. This gives attackers access to your database credentials and user data.

WordPress fixed this in version 7.1.1 by restricting how theme names are handled in the browser. Patchstack, a security firm that analyzed the flaw, notes that only administrators can trigger it. Author and Editor accounts don’t have the permission to install themes, so they’re safe from this specific chain.

If you run a small business site on WordPress, update to version 7.1.1 or later immediately. If you can’t update right away, enable the ‘DISALLOW_FILE_MODS’ setting to block forced installations. Also, be cautious of suspicious links sent to your staff, as the exploit requires an administrator to click a crafted URL.

This one is urgent. Complete technical details and a proof-of-concept exploit are already public. Two minutes of checking beats a weekend of cleanup. Update your site today.

Sources: BleepingComputer.