WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session

A new flaw in WordPress core let an anonymous visitor leave a comment that planted a hidden script on the page. If a logged-in administrator later opened that page, the script could run code on the site's server.

WordPress fixed the flaw, tracked as CVE-2026-93485 and dubbed "Comment2Shell," on September 17 in version 7.1.1 and told site owners to update right away. The researcher who reported it said he is not aware of it being used in attacks, and it is not on the U.S. government's list of actively exploited software flaws.

Patchstack, the company that assigned that identifier, rated the flaw 7.1 out of 10 on the CVSS scale.

WordPress checks a comment for dangerous HTML when it is saved, then reformats it when the page is shown, and the flaw sat in the gap between those two steps.

Rafie Muhammad, the security researcher who reported the bug, laid out the full chain in a write-up on September 21. The trick was a line break placed inside the attribute of an allowed HTML tag in the comment.

When WordPress reformatted the comment for display, one of its steps broke that tag apart and moved the attacker's text into a spot where the browser treated it as a live event handler. The handler ran automatically as the page loaded, with no click required.

The script ran in the browser of whoever opened the page, whether or not they were logged in, and it acted with that person's access level to the site.

Running code on the server needed one more condition. A logged-in administrator had to open the page carrying the comment.

The script could then use the administrator's own session to upload a plugin containing a web shell, a small file that executes whatever commands an attacker sends. Uploading a plugin this way is a known route from an administrator's browser to control of the server. Muhammad said the full chain was confirmed working end to end.

The attack also depended on how a site displayed its comments. It worked on sites that use a block theme, and Muhammad noted that every default WordPress theme since Twenty Twenty-Two is one. On a site with a classic theme, it worked only on posts or pages that contained comment blocks.

For any of this to happen, the comment had to appear on the page first. WordPress described the flaw as exploitable only "subject to comment approval."

But comment moderation is off by default, and the setting that holds a first-time commenter can be worked around, so a comment could reach the page without anyone approving it. As Patchstack put it, "moderation isn't a security control."

What to do

Update to WordPress 7.1.1, or to the latest release on your branch if it still gets security fixes. The affected versions run from 4.7 through 7.1, and these are the fixed releases for the current branches:

• WordPress 7.1: update to 7.1.1
• WordPress 7.0: update to 7.0.5
• WordPress 6.9: update to 6.9.8
• Older branches, back to 4.7: install the fixed release for your branch, as far back as 4.7.36, listed for each branch in WordPress's release documentation

A site that cannot update at once can shut the way in by closing comments on posts or turning comments off across the site, and a web application firewall or a security plugin may block the crafted comment.

Neither WordPress nor the researcher published a separate workaround. Muhammad recommended simply updating WordPress core, noting that 7.1.1 is a security release. Updating fixes the flaw, but it does not undo any change an attacker already made. A site with reason to think it was targeted should also look for plugins or files it does not recognize.

WordPress 7.1.1 fixed 11 security problems in all. This comment flaw was the only one that an attacker with no account could access, and most of the others required a logged-in user with some level of access.

The same release fixed a second flaw, called Click2Shell, in which a crafted link could make WordPress install a theme and, together with a second weakness in that theme, run code on the server. It, too, required a logged-in administrator to open the link.

WordPress core has had other serious flaws this year. In July, a bug called wp2shell let attackers run code with no login at all, and U.S. authorities later listed it as used in real attacks.

In August, researchers exploited a scripting flaw in the login page to execute code as an administrator. These are separate flaws from the comment bug.