WordPress Comment2Shell: How a Comment Could Become a Server Takeover

The WordPress team has closed a core vulnerability that could turn a harmless-looking comment into arbitrary code execution on a site's server. The bug carries the identifier CVE-2026-93485 and the nickname Comment2Shell. Patchstack, which assigned the identifier, rated it 7.1 out of 10 on the CVSS scale.

A gap between two checks

WordPress screens a comment for dangerous HTML when it is saved, then reformats it when the page is displayed. The flaw hid precisely in the gap between those two steps. According to security researcher Rafie Muhammad, who laid out the chain on September 21, the trick was a line break placed inside the attribute of an allowed HTML tag.

When the comment was reformatted, one of the steps broke the tag apart and moved the attacker's text to a spot where the browser treated it as a live event handler. The handler ran automatically as the page loaded — no click required. The script executed in the browser of whoever opened the page, with that person's level of access.

From XSS to the server

Reaching the server needed one more condition: a logged-in administrator had to open the page carrying the comment. The script then used the administrator's own session to upload a plugin containing a web shell — a small file that runs whatever commands an attacker sends. Uploading a plugin this way is a known route from an admin's browser to control of the server, and Muhammad confirmed the full chain works end to end.

The attack also hinged on how a site showed its comments. It worked on sites using a block theme — and every default WordPress theme since Twenty Twenty-Two is one. On classic themes, only posts containing comment blocks were exposed.

WordPress noted that exploitation was possible only "subject to comment approval." But moderation is off by default, and the setting that holds first-time commenters can be worked around. As Patchstack put it, "moderation isn't a security control."

What to do

Update to WordPress 7.1.1, or to the latest release on your branch if it still receives fixes. Affected versions run from 4.7 through 7.1; fixed releases include 7.1.1, 7.0.5, 6.9.8 and, going back to 4.7.36, a release for each branch. A site that cannot update at once can close comments or rely on a web application firewall or a security plugin.

Updating fixes the flaw but does not undo any change an attacker already made: a site with reason to suspect it was targeted should also look for unfamiliar plugins and files.

In all, 7.1.1 addressed 11 security problems. Comment2Shell was the only one reachable without an account. The same release fixed a second flaw, Click2Shell, in which a crafted link made WordPress install a theme and, via a further weakness, run code — though it, too, required an administrator to act.

Source: The Hacker News