A critical vulnerability in the WordPress core software has been patched, following the discovery of an attack chain that could allow a single click from an administrator to silently install a theme and potentially lead to full server compromise. Dubbed "Click2Shell," the flaw represents a significant risk to all unpatched WordPress installations worldwide.
The vulnerability resides in the core software itself, not in any third-party plugin or theme, broadening the scope of potential targets. Researchers from security firm pwn.ai, who reported the issue, outline a social engineering-based attack that requires minimal technical effort from the attacker. The chain begins when a privileged user, such as a site administrator, is tricked into clicking a crafted link while logged into the WordPress dashboard.
Upon clicking, the link forces the silent installation of a theme from the official WordPress.org repository, without any confirmation prompts. This action creates a foothold for an attacker. Security experts warn that this initial breach is not the end goal but a stepping stone. The malicious theme can be leveraged to chain with other weaknesses, escalating the attack to Remote Code Execution (RCE), which would grant the attacker complete control over the web server.
The primary and immediate mitigation is applying the core security patch released by WordPress. Administrators are urged to update their installations without delay. Following the update, it is recommended to audit server logs for any unauthorized theme installations that may have occurred around the disclosure date, which could indicate a prior compromise.
This incident underscores how security can hinge on a single user action, bypassing many technical defenses. For the vast ecosystem of WordPress sites, the path forward is clear: apply the patch immediately, reinforce administrative security awareness regarding unsolicited links, and review recent activity logs to confirm site integrity.
WordPress 核心軟件的一個關鍵漏洞已被修補。此前，研究人員發現了一種攻擊鏈，攻擊者只需單擊一下，即可由管理員觸發靜默安裝主題，並可能導致整個伺服器被入侵。這個被命名為「Click2Shell」的漏洞，對全球所有未經修補的WordPress安裝構成了重大風險。
該漏洞存在於核心軟件本身，而非任何第三方插件或主題，這擴大了潛在攻擊目標的範圍。發現此問題的安全公司pwn.ai的研究人員概述了一個基於社會工程的攻擊方法，攻擊者只需付出極小的技術努力。攻擊鏈始於當特權用戶（如網站管理員）在登入WordPress後台時，被誘騙點擊一個精心製作的連結。
一旦點擊該連結，系統將從官方WordPress.org軟件庫強制靜默安裝一個主題，過程中不會有任何確認提示。此操作為攻擊者創造了一個立足點。安全專家警告，這次初步入侵並非最終目的，而是一個墊腳石。惡意主題可被用來與其他弱點進行鏈式攻擊，將攻擊升級為遠端代碼執行（RCE），從而使攻擊者獲得對網絡伺服器的完全控制權。
首要且立即的緩解措施是應用WordPress發布的核心安全補丁。管理員應立即更新其安裝。更新後，建議審查伺服器日誌，以查找在漏洞披露日期前後可能發生的任何未經授權的主題安裝記錄，這可能表明系統曾遭入侵。
此事件凸顯了安全性如何可能繫於用戶的單一操作，從而繞過許多技術防禦。對於龐大的WordPress網站生態系統而言，前進的道路是明確的：立即應用補丁，加強管理員對未經請求連結的安全意識，並審查最近的活動日誌以確認網站完整性。