cyber.hendryadrian.com
Threat Research · picussecurity.com

Click2Shell Chains WordPress Theme Installation and a Vulnerable Plugin Installer for RCE

· Original article ↗

Summary

Click2Shell uses a crafted theme-preview link opened by a logged-in WordPress administrator to install a theme, then exploits Mobile Repair Zone 2.5.4’s plugin installer to run attacker-controlled PHP.

Key points

  • An administrator with permission to install themes must open the crafted link; the attacker does not need a WordPress account.
  • A jQuery selector injection in the theme-preview flow can trigger installation of a theme without the administrator clicking Install.
  • A subsequent Customizer request loads the installed theme’s functions.php even though the site’s original theme remains active.
  • The demonstrated chain targets Mobile Repair Zone 2.5.4, whose plugin installer accepts attacker-controlled package and PHP entry-point details.
  • The installer can download and extract the supplied package, then load its specified PHP file, enabling remote code execution.
  • The article describes a Picus Platform simulation for testing security controls against the attack chain.

Article Details

Attack Vectors
  • A crafted WordPress theme preview link injects CSS selector syntax, causing a logged-in administrator's browser to trigger the theme installation workflow.
  • After installation, a Customizer request loads the inactive theme's functions.php. The vulnerable plugin installer accepts attacker-controlled package and PHP entry-point values, downloads and extracts the package, then executes the selected PHP file.
Defensive Notes
  • The article recommends simulating Click2Shell with the Picus Platform to validate security controls.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationThe chain exploits a WordPress theme-preview selector injection and a vulnerable theme plugin installer to achieve server-side code execution.

Vendors

Picus Security

Products

Mobile Repair Zone 2.5.4The demonstrated chain targets Mobile Repair Zone 2.5.4, where a vulnerable plugin installer runs attacker controlled PHP.Picus PlatformThe Picus Platform lets teams simulate Click2Shell to validate security control effectiveness.WordPressClick2Shell lets an attacker trigger WordPress theme installation automatically once an administrator opens one crafted link.

Related Articles