A high-severity cross-site request forgery (CSRF) vulnerability in WordPress Core, codenamed 'Click2Shell,' has been publicly documented alongside a working proof-of-concept exploit, presenting an immediate risk of remote code execution on unpatched sites.

First detailed by BleepingComputer, the flaw resides within the core WordPress software itself, not a third-party plugin, meaning its potential impact is vast. The vulnerability allows an attacker to forge a request that, if triggered by a logged-in administrator, can upload and execute arbitrary PHP code on the server.

The attack requires tricking an administrator with an active session into visiting a malicious link. This single click can silently launch a forged request to the WordPress site, exploiting the CSRF weakness to gain shell access. Because the bug exists in the foundational code, all WordPress installations are potentially affected until secured.

Patches were released with WordPress version 6.4.3. However, remediation is not as simple as updating alone. The fix's effectiveness is contingent on strict server configuration; specifically, the web server user must lack write and execute permissions within the wp-content/uploads directory. Sites with lax permissions may remain vulnerable even after patching.

The public disclosure of technical details and a proof-of-concept code transforms this into an urgent operational threat. Attackers are now equipped with a clear blueprint for exploitation, making swift mitigation essential for any organization relying on the platform.

Essential Actions for IT Teams

Effective defense requires a layered approach:

  1. Apply the Patch Immediately: Update all WordPress installations to version 6.4.3 or later. This is the critical first step.
  2. Harden Server Permissions: Audit and restrict filesystem permissions for the wp-content/uploads directory. The web server process should not have both write and execute rights here.
  3. Review Security Posture: Examine server and application logs for suspicious activity. Additionally, enforce robust administrative controls like multi-factor authentication (MFA) and monitor active sessions, as compromising an admin account is a prerequisite for this attack.
  4. Assess User Management: On sensitive sites, consider tightening user registration controls to reduce the attack surface.

This incident reinforces the need for vigilant patch management and secure server hardening as non-negotiable components of WordPress maintenance. Administrators should prioritize verifying updates and configurations immediately to close this dangerous exposure.

WordPress核心中一個被命名為「Click2Shell」的高嚴重性跨站請求偽造（CSRF）漏洞已被公開記錄，並附有可用的概念驗證（proof-of-concept）漏洞利用程式，這對未修補的網站構成立即的遠端程式碼執行風險。

此漏洞最早由BleepingComputer詳細報導，它存在於WordPress核心軟體本身，而非第三方插件，意味著其潛在影響範圍極廣。該漏洞允許攻擊者偽造一個請求，若由已登入的管理員觸發，便能在伺服器上上傳並執行任意PHP程式碼。

此攻擊需要誘騙一個擁有有效工作階段的管理員造訪惡意連結。單一次點擊便可悄無聲息地向WordPress網站發起偽造的請求，利用CSRF弱點取得shell存取權限。由於此缺陷存在於基礎程式碼中，所有WordPress安裝在修補前都可能受到影響。

補丁已隨WordPress 6.4.3版本發布。然而，補救措施並非僅僅更新那麼簡單。修補的有效性取決於嚴格的伺服器配置；具體而言，網頁伺服器使用者必須在wp-content/uploads目錄中缺乏寫入及執行權限。權限設定較為寬鬆的網站即使在套用補丁後，可能仍存在漏洞。

技術細節及概念驗證程式的公開披露，已將此事件轉化為緊急的運營威脅。攻擊者現在掌握了明確的漏洞利用藍圖，這使得任何依賴該平台的組織都必須迅速採取緩解措施。

IT團隊的必要行動

有效防禦需要採取多層次的方法：

  1. 立即套用補丁： 將所有WordPress安裝更新至6.4.3或更高版本。這是至關重要的第一步。
  2. 強化伺服器權限： 審計並限制wp-content/uploads目錄的檔案系統權限。網頁伺服器進程不應在此目錄同時擁有寫入及執行權限。
  3. 審視安全態勢： 檢查伺服器及應用程式日誌中的可疑活動。此外，應實施強大的管理控制措施，如多重驗證（MFA），並監控活動工作階段，因為入侵管理員帳戶是此攻擊的先決條件。
  4. 評估使用者管理： 在敏感網站上，可考慮收緊使用者註冊控制以減少攻擊面。

這次事件凸顯了保持警惕的補丁管理與安全的伺服器加固作為WordPress維護不可協商環節的必要性。管理員應優先立即驗證更新與配置，以關閉此危險的暴露面。

新聞來源 / Original News Source