WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session

A new flaw in WordPress core let an anonymous visitor leave a comment that planted a hidden script on the page. If a logged-in administrator later opened that page, the script could run code on the site's server. WordPress fixed the flaw, tracked as  CVE-2026-93485  and called " Comment2Shell ," on September 17 in  version 7.1.1  and told site owners to update right away. There is no sign it has been used in attacks, and it is not on the U.S. government's list of actively exploited software flaws. Patchstack, the company that assigned that identifier, rated the flaw 7.1 out of 10 on the CVSS scale. WordPress checks a comment for dangerous HTML when it is saved, then reformats it when the page is shown, and the flaw sat in the gap between those two steps. Rafie Muhammad, the security researcher who reported the bug, laid out the full chain in  a write-up  on September 21. The trick was a line break placed inside the attribute of an allowed HTML tag in the comment. When WordPress reformatted the comment for display, one of its steps broke that tag apart and moved the attacker's text into a spot where the browser treated it as a live event handler. The handler ran automatically as the page loaded, with no click required. The script ran in the browser of whoever opened the page, whether or not they were logged in, and it acted with that person's access level to the site. Running code on the server needed one more condition. A logged-in administrator had to open the page carrying the comment. The script could then use the administrator's own session to upload a plugin containing a web shell, a small file that executes whatever commands an attacker sends. Uploading a plugin this way is a known route from an administrator's browser to control of the server. The attack also depended on how a site displayed its comments. It worked on sites that use a block theme, which has been the default in WordPress since Twenty Twenty-Two. Some classic themes were affected too, where they format comments through the same step; the write-up names Twenty Twenty-One as one. For any of this to happen, the comment had to appear on the page first. WordPress described the flaw as exploitable only "subject to comment approval." By default, a comment from a new author is held until someone approves it, so it does not appear on its own. But the researcher described ways around that check, letting a comment reach the page without approval. As Patchstack put it,  "moderation isn't a security control." What to do Update to WordPress 7.1.1, or to the latest release on your branch if it still gets security fixes. The affected versions run from 4.7 through 7.1, and these are the fixed releases for the current branches: WordPress 7.1: update to 7.1.1 WordPress 7.0: update to 7.0.5 WordPress 6.9: update to 6.9.8 Older branches, back to 4.7: install the fixed release for your branch, as far back as 4.7.36,  listed for each branch in WordPress's release documentation A site that cannot update at once can shut the way in by closing comments on posts or turning comments off across the site, and a web application firewall or a security plugin may block the crafted comment. Neither WordPress nor the researcher published a separate workaround. Muhammad recommended simply updating WordPress core, noting that 7.1.1 is a security release. Updating fixes the flaw, but it does not undo any change an attacker already made. A site with reason to think it was targeted should also look for plugins or files it does not recognize. WordPress 7.1.1 fixed 11 security problems in all. This comment flaw was the only one that an attacker with no account could access, and most of the others required a logged-in user with some level of access. The same release fixed a second flaw, called  Click2Shell , in which a crafted link could make WordPress install a theme and, together with a second weakness in that theme, run code on the server. It, too, required a logged-in administrator to open the link. WordPress core has had other serious flaws this year. In July, a bug called  wp2shell  let attackers run code with no login at all, and U.S. authorities later listed it as used in real attacks. In August, researchers turned  a scripting flaw in the login page  into code execution through an administrator. These are separate flaws from the comment bug. Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post.