Index: src/wp-admin/admin-ajax.php
===================================================================
--- src/wp-admin/admin-ajax.php	(revision 27943)
+++ src/wp-admin/admin-ajax.php	(working copy)
@@ -58,7 +58,7 @@
 	'wp-remove-post-lock', 'dismiss-wp-pointer', 'upload-attachment', 'get-attachment',
 	'query-attachments', 'save-attachment', 'save-attachment-compat', 'send-link-to-editor',
 	'send-attachment-to-editor', 'save-attachment-order', 'heartbeat', 'get-revision-diffs',
-	'save-user-color-scheme', 'update-widget',
+	'save-user-color-scheme', 'update-widget', 'query-themes',
 );
 
 // Register core Ajax calls.
Index: src/wp-admin/includes/ajax-actions.php
===================================================================
--- src/wp-admin/includes/ajax-actions.php	(revision 27943)
+++ src/wp-admin/includes/ajax-actions.php	(working copy)
@@ -2204,3 +2204,27 @@
 	update_user_meta( get_current_user_id(), 'admin_color', $color_scheme );
 	wp_send_json_success();
 }
+
+/**
+ * Proxy requests for themes
+ *
+ * @since 3.8.0
+ */
+function wp_ajax_query_themes(){
+
+
+	check_ajax_referer( 'query-themes', 'nonce' );
+
+	$base_url = 'http://api.wordpress.org/themes/info/1.1/?action=query_themes';
+
+	$return = wp_remote_post( $base_url, array(
+		'body' => array( 'request' => $_REQUEST['request'] )
+	));
+
+	if ( is_wp_error( $return ) ) {
+		wp_send_json_error();
+	}
+
+	wp_send_json_success( json_decode( $return['body'] ) );
+
+}
Index: src/wp-admin/js/theme.js
===================================================================
--- src/wp-admin/js/theme.js	(revision 27943)
+++ src/wp-admin/js/theme.js	(working copy)
@@ -249,10 +249,12 @@
 			this.currentQuery.page = 1;
 		}
 
+
 		// Otherwise, send a new API call and add it to the cache.
 		if ( ! query && ! isPaginated ) {
 			query = this.apiCall( request ).done( function( data ) {
 				// Update the collection with the queried data.
+				data = data.data;
 				self.reset( data.themes );
 				count = data.info.results;
 
@@ -274,6 +276,7 @@
 			// If it's a paginated request we need to fetch more themes...
 			if ( isPaginated ) {
 				return this.apiCall( request, isPaginated ).done( function( data ) {
+					data = data.data;
 					// Add the new themes to the current collection
 					// @todo update counter
 					self.add( data.themes );
@@ -287,7 +290,7 @@
 				});
 			}
 
-			if ( query.themes.length === 0 ) {
+			if ( query.data.themes.length === 0 ) {
 				self.trigger( 'query:empty' );
 			} else {
 				$( 'body' ).removeClass( 'no-results' );
@@ -295,15 +298,15 @@
 
 			// Only trigger an update event since we already have the themes
 			// on our cached object
-			if ( _.isNumber( query.total ) ) {
-				this.count = query.total;
+			if ( _.isNumber( query.data.total ) ) {
+				this.count = query.data.total;
 			}
 
-			if ( ! query.total ) {
+			if ( ! query.data.total ) {
 				this.count = this.length;
 			}
 
-			this.reset( query.themes );
+			this.reset( query.data.themes );
 			this.trigger( 'update' );
 		}
 	},
@@ -322,16 +325,16 @@
 
 		// Ajax request to .org API
 		return $.ajax({
-			url: 'https://api.wordpress.org/themes/info/1.1/?action=query_themes',
+			url: ajaxurl,
 
 			// We want JSON data
 			dataType: 'json',
 			type: 'POST',
-			crossDomain: true,
 
 			// Request data
 			data: {
-				action: 'query_themes',
+				action: 'query-themes',
+				nonce: $('#query-theme-nonce').val(),
 				request: _.extend({
 					per_page: 72,
 					fields: {
@@ -1553,6 +1556,7 @@
 	}
 };
 
+
 // Ready...
 $( document ).ready(function() {
 	if ( themes.isInstall ) {
Index: src/wp-admin/theme-install.php
===================================================================
--- src/wp-admin/theme-install.php	(revision 27943)
+++ src/wp-admin/theme-install.php	(working copy)
@@ -148,6 +148,7 @@
 				<a href="#"><?php _e( 'Edit' ); ?></a>
 			</div>
 		</div>
+		<?php wp_nonce_field( 'query-themes', 'query-theme-nonce' ); ?>	 
 	</div>
 	<div class="theme-browser"></div>
 	<div id="theme-installer" class="wp-full-overlay expanded"></div>