"moderation isn't a security control," Patchstack warned, bluntly summing up how a cleverly crafted comment could turn into remote code execution on vulnerable WordPress sites.
How Comment2Shell (CVE-2026-93485) turns an anonymous comment into server code
Researchers and WordPress developers described a multipart chain now tracked as CVE-2026-93485 and dubbed "Comment2Shell." The initial stage is an ordinary-looking comment that contains an allowed HTML tag with a line break inserted inside one of its attributes. WordPress checks a comment for dangerous HTML when it is saved, then reformats it when the page is shown; the vulnerability lay in the gap between those two steps.
When WordPress reformatted the comment for display, a reformatting step broke the tag and moved the attacker's text into a place the browser treated as a live event handler. That handler executed automatically as the page loaded — no click required — and ran in the browser of whoever viewed the page, acting with that person's access level on the site. Rafie Muhammad laid out the full chain in a write-up published on September 21.
Which WordPress versions, themes, and settings made sites exploitable
WordPress fixed the flaw on September 17 in version 7.1.1 and told site owners to update immediately. Patchstack, which assigned the CVE identifier, rated the flaw 7.1 out of 10 on the CVSS scale. Affected versions run from 4.7 through 7.1; WordPress listed fixed releases for current branches including 7.1.1, 7.0.5, 6.9.8 and back-ported fixes as far as 4.7.36.
The attack only succeeds on sites that actually display the malicious comment. It worked on sites using a block theme or a classic theme that formats comments the same way, and did not work on other themes. WordPress described exploitability as "subject to comment approval," but the practical risk was higher: comment moderation is off by default, and the setting that holds a first-time commenter can be worked around, enabling a crafted comment to appear without a human approver.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildWhy an administrator's session is the pivot from browser script to server control
The in-browser script runs for any viewer and inherits that viewer's privileges. Reaching remote code execution on the server required a further condition: a logged-in administrator had to open the page containing the comment. In that scenario the script could use the administrator's session to upload a plugin that contains a web shell — a small file that executes commands an attacker sends — and installing a plugin via an administrator's browser is a known route to server control.
WordPress noted that this comment flaw was the only one among the 11 security problems fixed in 7.1.1 that an unauthenticated attacker could reach; most of the others required at least some level of login access.
Mitigations: update, or close the comment doorway
The authoritative mitigation is to update: move to WordPress 7.1.1 or to the latest fixed release on whatever branch your site uses. If you cannot update immediately, the practical mitigations are to close comments on posts, turn comments off sitewide, or use a web application firewall or security plugin that may block the crafted comment. Neither WordPress nor Rafie Muhammad published a separate workaround; updating repairs the vulnerable processing but does not reverse any changes an attacker may already have made.
WordPress also fixed a related, separately named issue in the same release: "Click2Shell," in which a crafted link could trigger a theme installation and, combined with a second weakness in that theme, result in server code execution — again requiring a logged-in administrator to open the link. The core project has had other serious flaws this year: in July a bug called wp2shell let attackers run code with no login and was later listed by U.S. authorities as used in real attacks; in August researchers exploited a scripting flaw on the login page to execute code as an administrator. Those are distinct from the comment bug but underline a pattern of high-impact fixes.
What this means for site owners, administrators, and security teams
- Site owners: update as soon as possible to the fixed release on your branch (7.1.1 for 7.1, 7.0.5 for 7.0, 6.9.8 for 6.9, or the listed backport release down to 4.7.36). If you believe your site may have been targeted, search for plugins or files you do not recognize — updating will not remove an attacker-installed web shell.
- Administrators: be aware that viewing a page while logged in can be the attacker's path to server code; consider closing comments temporarily and audit administrative accounts and recent uploads if exploitation is suspected.
- Security teams: deploy or tune web application firewalls and security plugins to detect and block unusual comment payloads, and monitor for signs of plugin uploads or changes to files on disk.
WordPress's fix addresses the specific reformatting gap that allowed an allowed HTML tag, split by a line break, to become an executable handler. The immediate action is clear: update, or shut the comment door until you can. The longer question — already reflected in multiple separate fixes this year — is how such parsing gaps interact with theme and comment-handling code across the WordPress ecosystem.
Original reporting: https://thehackernews.com/2026/09/wordpress-comment2shell-flaw-can-turn.html
