After 1,155 days of 0-day protection for every critical vulnerability - BitFire did not stop Click2Shell at disclosure. Learn why, what we deployed on September 20, and how PRO RASP protection will expand.
wp-admin/js/theme.js; Mobile Repair Zone 2.5.4 AJAX installerClick2Shell is a WordPress Core selector-injection chain that BitFire did not stop when it was disclosed. An unauthenticated attacker persuades a logged-in administrator to visit a crafted theme-preview URL. WordPress then installs an official catalog theme without another click. A Customizer request can load the inactive theme's PHP; Mobile Repair Zone 2.5.4 exposed an AJAX installer that fetched, unpacked, and loaded an attacker-selected plugin. The researchers assessed the demonstrated chain at CVSS 9.3, although WordPress had not issued a CVE or final severity. BitFire deployed firewall rules blocking off-site POSTs to `/wp-admin/admin-ajax.php` on September 20 and is developing broader BitFire PRO RASP enforcement for this attack class.
The affected component, attack path, and practical risk for WordPress websites.
BitFire did not stop Click2Shell at disclosure. We shipped a firewall mitigation on September 20 and are building origin-aware PRO RASP enforcement for future attacks in this class.
Research details, affected versions, exploitation behavior, and remediation guidance.
The Core flaw begins at `/wp-admin/theme-install.php?theme=...`. WordPress.org canonicalizes the crafted value to a real catalog slug, while the administrator's browser reuses the unescaped original value as a jQuery selector. Injected selector syntax reaches the genuine Install control, and WordPress spends the administrator's nonce and `install_themes` capability. The theme remains inactive, but a Customizer request can load its PHP. Mobile Repair Zone 2.5.4 then registered an authenticated AJAX installer without its own nonce or capability check. That handler accepted a plugin URL, fetched the package, wrote it under the plugins directory, unpacked it, and loaded the selected PHP entry point. The Core primitive alone is forced catalog-theme installation; PHP execution requires the second flaw.
Click2Shell crossed our controls in ways they were not designed to reject. The administrator used a real, verified browser, so Bot Protection correctly treated the visitor as human. The first request carried selector syntax rather than SQL injection, XSS, object injection, traversal, or another standard WAF payload class. The follow-on AJAX POST used ordinary-looking plugin metadata, while the vulnerable server fetched the ZIP itself instead of receiving a malicious file upload for inspection. Most importantly, the attack rode a valid administrator session. At disclosure, BitFire had no origin-aware rule that treated an off-site POST to `admin-ajax.php` as unauthorized. We therefore cannot claim the standard WAF or BitFire PRO RASP stopped this chain: they did not.
On Sunday, September 20 the day after public disclosure, BitFire pushed new firewall filtering rules to free and PRO clients that block this specific clik2shell attack. This targets the initial link an attacker must trick an administrator into clicking to exploit the vulnerability. The mitigation does not repair WordPress Core or clean an already compromised site. It is a focused request-layer interruption based on provenance, not a claim that the selector-injection payload matches a generic WAF signature. Site owners should still install WordPress 7.1.1 or later as soon as possible to address this and other vulnerabilities.
BitFire is investigating a BitFire PRO RASP control that will prevent off-site POSTs to `/wp-admin/admin-ajax.php`, closing the trust gap that let a foreign page drive a sensitive action through a legitimate administrator browser. The control is scheduled to roll out to PRO clients in alert-only mode during September. Alert mode records matches but does not block them, giving us evidence about legitimate integrations and false positives. After one month of evaluation with no false positives, enforcement will move to blocking. This mechanism is broader than a Click2Shell signature: RASP clients will receive protection against future vulnerabilities in the same class, where an external origin attempts to invoke an AJAX operation through an authenticated WordPress session.
WordPress 7.1.1 escapes the URL-derived slug with `$.escapeSelector()` and limits the selector to a real `div.theme` card, preventing the forced Install click. Patch immediately, and remove or update Mobile Repair Zone 2.5.4 when a vendor-fixed release is available. Patching closes the known routes but does not remove an earlier compromise. Sites that ran affected software should investigate, remove discovered persistence, and rotate relevant WordPress, hosting, database, SSH, and SFTP credentials. BitFire Threat Hunter can uncover backdoor administrator accounts, hidden database triggers, long-running PHP processes, and droppers capable of restoring malware. The absence of an obvious malicious plugin does not prove the site is clean.
BitFire failed to stop the disclosed Click2Shell chain, and WordPress owners deserve that fact without evasive marketing. The immediate firewall rule now blocks its initial attack vector stage, while the planned BitFire PRO RASP control is being evaluated for safe, durable enforcement across this vulnerability class. Update WordPress now, investigate any previously exposed site with Threat Hunter, BitFire rules auto update daily so sites are already protected. Protection improves when failures are analyzed precisely, mitigations ship quickly, and runtime controls evolve from evidence rather than unsupported claims.
The relevant source is located in wp-admin/js/theme.js; Mobile Repair Zone 2.5.4 AJAX installer.
$( 'div[data-slug="' + slug + '"]' ).trigger( 'click' );$( 'div.theme[data-slug="' + $.escapeSelector( slug ) + '"]' ).trigger( 'click' );BitFire protects WordPress servers on day zero—before a vulnerability is publicly known and before other vendors have time to develop signatures or patches.
Bot controls and browser verification stop untrusted automated clients before previously unknown exploit code reaches WordPress.
General WAF protections identify dangerous request behavior and hostile payloads without waiting for a vulnerability-specific signature.
RASP follows execution inside PHP and prevents unauthorized changes to protected files, accounts, and database content.
BitFire combines bot controls, request inspection, malware detection, and runtime protection in one WordPress security platform.