conv.

← The whole story
Security
WordPress Click2Shell Flaw Lets Admins Unwittingly Install Malicious Themes

pwn.ai releases full technical analysis of the attack chain

2 Sep 21 8:12 AM · 2d ago · 1 post · 1 source · development 2 of 3

Security firm pwn.ai published detailed technical analysis showing how the core flaw works: WordPress.org's directory parser and the admin browser's DOM parser read URLs differently, allowing attackers to inject characters that trigger the Install button. The firm demonstrated chaining the forced install with a weakness in the Mobile Repair Zone theme to achieve code execution.

pwn.ai releases full technical analysis of the attack chain
github.com

“The Core bug does not accept an arbitrary theme ZIP by itself.”

pwn.ai

pwn.ai Security research firmWordPress Software vendor

The whole story articlesposts the bright band is this development · numbered dots are the others · click one to jump

Peak 6 pieces in one hour at Sep 20, 5 AM; 48 pieces over 4 days (13 articles · 15 posts · 20 comments) Sep 20, 5 AM — 6 pieces · 6 articles — Google News 6Sep 20, 6 AM — quietSep 20, 7 AM — quietSep 20, 8 AM — quietSep 20, 9 AM — quietSep 20, 10 AM — quietSep 20, 11 AM — quietSep 20, 12 PM — quietSep 20, 1 PM — quietSep 20, 2 PM — quietSep 20, 3 PM — quietSep 20, 4 PM — quietSep 20, 5 PM — quietSep 20, 6 PM — quietSep 20, 7 PM — quietSep 20, 8 PM — quietSep 20, 9 PM — quietSep 20, 10 PM — quietSep 20, 11 PM — quietSep 21, 12 AM — quietSep 21, 1 AM — quietSep 21, 2 AM — quietSep 21, 3 AM — quietSep 21, 4 AM — quietSep 21, 5 AM — quietSep 21, 6 AM — quietSep 21, 7 AM — 1 piece · 1 post — Mastodon 1Sep 21, 8 AM — quietSep 21, 9 AM — quietSep 21, 10 AM — quietSep 21, 11 AM — quietSep 21, 12 PM — quietSep 21, 1 PM — 1 piece · 1 post — Mastodon 1Sep 21, 2 PM — quietSep 21, 3 PM — quietSep 21, 4 PM — quietSep 21, 5 PM — quietSep 21, 6 PM — quietSep 21, 7 PM — quietSep 21, 8 PM — quietSep 21, 9 PM — quietSep 21, 10 PM — quietSep 21, 11 PM — quietSep 22, 12 AM — 1 piece · 1 post — Mastodon 1Sep 22, 1 AM — quietSep 22, 2 AM — quietSep 22, 3 AM — 1 piece · 1 post — Mastodon 1Sep 22, 4 AM — quietSep 22, 5 AM — 2 pieces · 1 article · 1 post — Mastodon 1, Newswires 1Sep 22, 6 AM — quietSep 22, 7 AM — quietSep 22, 8 AM — quietSep 22, 9 AM — quietSep 22, 10 AM — quietSep 22, 11 AM — 2 pieces · 1 article · 1 post — Hacker News 1, Newswires 1Sep 22, 12 PM — 3 pieces · 1 post · 2 comments — Hacker News 2, X 1Sep 22, 1 PM — 6 pieces · 6 comments — Hacker News 6Sep 22, 2 PM — 3 pieces · 3 comments — Hacker News 3Sep 22, 3 PM — quietSep 22, 4 PM — 4 pieces · 2 posts · 2 comments — Hacker News 2, Mastodon 2Sep 22, 5 PM — quietSep 22, 6 PM — 1 piece · 1 comment — Hacker News 1Sep 22, 7 PM — quietSep 22, 8 PM — quietSep 22, 9 PM — quietSep 22, 10 PM — quietSep 22, 11 PM — 1 piece · 1 comment — Hacker News 1Yesterday, 12 AM — 1 piece · 1 post — Mastodon 1Yesterday, 1 AM — quietYesterday, 2 AM — quietYesterday, 3 AM — 1 piece · 1 comment — Hacker News 1Yesterday, 4 AM — 4 pieces · 4 articles — Google News 4Yesterday, 5 AM — 1 piece · 1 comment — Hacker News 1Yesterday, 6 AM — 1 piece · 1 article — Mastodon 1Yesterday, 7 AM — 2 pieces · 1 post · 1 comment — Hacker News 1, Mastodon 1Yesterday, 8 AM — 1 piece · 1 post — Mastodon 1Yesterday, 9 AM — quietYesterday, 10 AM — 1 piece · 1 comment — Hacker News 1Yesterday, 11 AM — quietYesterday, 12 PM — quietYesterday, 1 PM — 2 pieces · 2 posts — Mastodon 2Yesterday, 2 PM — quietYesterday, 3 PM — quietYesterday, 4 PM — quietYesterday, 5 PM — 1 piece · 1 comment — Hacker News 1Yesterday, 6 PM — quietYesterday, 7 PM — quietYesterday, 8 PM — quietYesterday, 9 PM — quietYesterday, 10 PM — 1 piece · 1 post — Hacker News 1Yesterday, 11 PM — quietToday, 12 AM — quietToday, 1 AM — quiet 123
1Click2Shell vulnerability details…2pwn.ai releases full technical analysis…3Public exploit code released for…
Sep 21Sep 22yesterdaynow · 2:58 AM ET

All 3 developments of WordPress Click2Shell Flaw Lets Admins Unwittingly Install… →

Google NewsMastodonNewswiresHacker NewsX