Affected Systems
WordPress core versions 6.0 through 7.1.0. Patched in WordPress 7.1.1 and backported security releases for all supported branches back to 4.7. Exploitation requires logged-in administrator to open crafted link.
Exploitation Status
No evidence of active exploitation in the wild. Proof-of-concept demonstrated by pwn.ai security researchers. Attack chain requires administrator interaction (opening malicious link) and a second vulnerability in a target theme to achieve code execution.
Business Impact
Attackers can force installation of arbitrary themes from WordPress.org directory when a logged-in administrator opens a specially crafted URL. Installed themes remain inactive and do not alter site appearance, making detection difficult. When chained with a vulnerable theme (e.g., Mobile Repair Zone), attackers achieve remote code execution. pwn.ai rates the forced-install flaw at CVSS 7.1 (high) and the full chain at 9.6 (critical). WordPress has not published its own severity rating. No CVE assigned yet, though WordPress plans to issue one.
Urgency
🟠Within 24 hours
Recommended Actions
- Update WordPress core to version 7.1.1 immediately, or apply the corresponding security patch for your supported branch (patches available back to 4.7).
- Verify automatic updates are enabled for WordPress core to receive security patches without manual intervention.
- Review installed themes for unexpected additions, particularly those that remain inactive, and remove any unauthorized themes.
- Educate WordPress administrators to avoid clicking links from untrusted sources, especially when logged into the admin panel.
- Monitor WordPress admin activity logs for unexpected theme installations or Customizer preview requests that could indicate exploitation attempts.