WordPress 'Comment2Shell' Flaw Allows RCE via Admin Session

A critical vulnerability discovered in the core of WordPress, identified as CVE-2026-93485 and nicknamed "Comment2Shell," has been patched by the content management system's developers. This flaw allowed unauthenticated attackers to achieve remote code execution (RCE) on a targeted server by exploiting a gap in how WordPress handles comments.

The vulnerability resided in the discrepancy between how WordPress sanitizes comments upon submission and how it reformats them for display. An attacker could craft a malicious comment containing a specially formatted line break within an HTML tag attribute. When WordPress processed this comment for display, it would inadvertently break the tag apart, inserting the attacker's script into an event handler that executed automatically when the page loaded.

While the script initially ran in the visitor's browser, its true danger was realized when a logged-in administrator viewed the page containing the malicious comment. The script would then execute with the administrator's privileges, allowing it to perform actions on the site as if the admin themselves were executing them. This could include uploading a plugin containing a web shell, effectively giving the attacker full control over the server.

Exploitation of Comment2Shell was contingent on specific site configurations. It was most effective on sites using block themes or classic themes that formatted comments in a similar manner. Furthermore, the attack required the malicious comment to be published on the page. Although comment moderation is a standard security measure, the vulnerability could still be exploited if comment approval was disabled or if a first-time commenter's approval was bypassed, highlighting that "moderation isn't a security control" as noted by Patchstack.

WordPress addressed this critical RCE risk by releasing version 7.1.1 on September 17th. The company urged all site owners to update immediately to the latest available version for their respective WordPress branches. Affected versions range from 4.7 through 7.1, with specific patched releases provided for various branches, including 7.1.1 for 7.1, 7.0.5 for 7.0, and 6.9.8 for 6.9.

For sites unable to update immediately, temporary mitigation strategies include disabling comments on posts or site-wide. Additionally, web application firewalls (WAFs) or security plugins might be configured to block the crafted comments. However, these measures do not undo any damage already caused by a successful exploit.

Patchstack, the firm that assigned the CVE, rated the vulnerability's severity at 7.1 out of 10 on the CVSS scale. While there have been no reported instances of this specific vulnerability being exploited in the wild, and it is not currently listed on the U.S. government's Known Exploited Vulnerabilities (KEV) catalog, its potential impact is significant.

This vulnerability is one of several serious security issues addressed in WordPress 7.1.1, which included a total of 11 fixes. Notably, the same release also patched a separate flaw called "Click2Shell," which required a logged-in administrator to click a crafted link to install a theme and potentially execute code. The Comment2Shell flaw, however, stands out due to its ability to be triggered by an unauthenticated user through a seemingly innocuous comment, provided an administrator later views the page.