A newly patched flaw in WordPress core let an anonymous visitor plant a hidden script in a blog comment that could take over the site the moment a logged-in administrator opened the page. The bug, tracked as CVE-2026-93485 and nicknamed Comment2Shell, was fixed on 17 September 2026 in WordPress 7.1.1 after researcher Rafie Muhammad reported it. Patchstack scored the issue 7.1 on the CVSS scale. Muhammad said he is not aware of in-the-wild abuse, and the flaw is not (yet) listed in CISA’s Known Exploited Vulnerabilities catalog—but the attack chain is end-to-end reliable, requires no authenticated foothold to start, and affects a vast installed base still running versions from 4.7 through 7.1.
WordPress sanitises comments when they are saved, then reformats them when pages are rendered. Comment2Shell lived in the gap between those steps. Muhammad showed that a carefully placed line break inside an attribute of an otherwise allowed HTML tag survived storage. During display reformatting, WordPress broke the tag apart and moved attacker-controlled text into a position the browser treated as a live event handler. The handler fired automatically on page load—no click required—running in the browser of whoever viewed the comment, with that person’s privileges on the site.
From stored XSS to remote code execution
Cross-site scripting alone is serious on a CMS that powers a large share of the public web. Comment2Shell becomes catastrophic when the viewer is an administrator. The injected script can reuse the admin’s authenticated session to upload a plugin containing a web shell, a well-known path from browser control to full server compromise. Muhammad confirmed the full chain worked in testing.
Exploitation depends on how comments are displayed. It succeeds on sites using a block theme—and every default WordPress theme since Twenty Twenty-Two is a block theme. On classic themes, it works only on posts or pages that contain comment blocks. WordPress described the flaw as exploitable “subject to comment approval,” but comment moderation is off by default, and first-commenter holds can be bypassed. As Patchstack put it, moderation is not a security control.
Click2Shell and a rough year for WordPress core
The same 7.1.1 security release fixed eleven issues. Comment2Shell was the only one reachable by an attacker with no account. A second flaw in the same release, dubbed Click2Shell, lets a crafted link cause WordPress to install a theme that, combined with a second weakness, runs code on the server—again requiring a logged-in administrator to open the link. Earlier in 2026, the wp2shell bug allowed unauthenticated remote code execution and later appeared on CISA’s KEV list after real-world abuse. In August, researchers chained a login-page scripting flaw to administrator code execution. Comment2Shell is separate from those bugs, but it continues a pattern: WordPress’s enormous attack surface keeps yielding high-impact chains that start with modest input flaws.
For hosting providers, agencies and small businesses across the Nordics and Europe, the practical risk is volume. Millions of sites still run older branches; many leave comments open for engagement; and administrators routinely preview posts while logged in with full privileges. A single unmoderated comment can become a silent trap.
What site owners should do now
- Update immediately to WordPress 7.1.1, or to the fixed release on your maintained branch (7.0.5, 6.9.8, and back-ports as far as 4.7.36 listed in WordPress’s release notes). Versions 4.7 through 7.1 were affected.
- If you cannot patch at once: close comments on posts or disable comments site-wide; a web application firewall or security plugin may block crafted comment payloads as a temporary bridge.
- After updating, assume nothing about past comments. Patching stops new exploitation; it does not remove a web shell already uploaded. Hunt for unfamiliar plugins, PHP files in uploads directories, and unexpected admin users.
- Separate browsing roles. Do not preview front-end content while logged into `wp-admin` on the same browser profile; use a separate unprivileged session for reading the public site.
- Hosts and agencies: force core updates across managed fleets, alert customers still on pre-7.1.1 builds, and scan for webshell indicators tied to recent plugin uploads.
Evidence status
- Confirmed: WordPress shipped 7.1.1 fixing CVE-2026-93485; Patchstack assigned the CVE and CVSS 7.1; Muhammad published a full technical write-up on 21 September 2026 confirming the XSS-to-RCE chain.
- Reported: The Hacker News summarised Comment2Shell and the related Click2Shell fix on 22 September 2026.
- Unconfirmed: Any confirmed mass exploitation in the wild; CISA KEV listing had not occurred at the time of this article.
In brief
- Comment2Shell (CVE-2026-93485) lets an anonymous WordPress comment execute script in visitors’ browsers and, if an administrator views it, upload a webshell via the admin session.
- WordPress 7.1.1 and matching back-ports close the bug; moderation alone is not reliable protection.
- Site owners should patch now, review comments and plugins for tampering, and stop browsing the public site while logged in as administrator.