WordPress patches Comment2Shell comment-to-RCE vulnerability

WordPress releases fixes for Comment2Shell

WordPress has patched CVE-2026-93485, a vulnerability dubbed Comment2Shell that could let an anonymous visitor plant a malicious script in a comment and ultimately gain server-side code execution if a logged-in administrator opened the affected page. The issue was fixed on September 17 in WordPress 7.1.1.

Patchstack, which assigned the identifier, rated the flaw 7.1 out of 10 under CVSS. WordPress said site owners should update promptly. At the time of publication, there was no evidence of exploitation and the vulnerability was not listed by U.S. authorities as actively exploited.

How the comment chain worked

WordPress checks comments for dangerous HTML when they are saved and reformats the content when it is displayed. Rafie Muhammad, who reported the bug and published the full chain on September 21, found that a line break inside an attribute of an allowed HTML tag could pass through the first stage but be altered during rendering.

That rendering step could split the tag and place attacker-controlled content where the browser interpreted it as a live event handler. The handler ran automatically as the page loaded, without requiring a click. It executed in the browser of the person viewing the page and inherited that user’s level of access to the site.

The path to server control required an administrator to be logged in and to open the page containing the malicious comment. The script could then use that administrator’s session to upload a plugin carrying a web shell. For context, a separate WordPress core RCE risk outlines a separate WordPress core RCE risk, while this flaw depends on an administrator viewing a published comment.

Theme and moderation conditions

The exploit affected sites using a block theme, as well as classic themes that format comments in the same way. It did not apply to all comment displays. The comment also had to appear on the page before an administrator could encounter it.

WordPress described exploitation as being subject to comment approval. However, comment moderation is disabled by default, and the option that holds comments from first-time commenters can be bypassed. Patchstack’s assessment was that moderation should not be treated as a security control.

Versions to install and checks to make

Affected versions range from WordPress 4.7 through 7.1. Current supported branches should move to WordPress 7.1.1, 7.0.5, or 6.9.8 as applicable. Older maintained branches should install their corresponding fixed release, with fixes listed back to version 4.7.36.

WordPress 7.1.1 addressed 11 security issues. Comment2Shell was the only issue in that release accessible to an attacker without an account; most of the others required a logged-in user with some degree of access. The release also fixed Click2Shell, a separate issue involving a crafted link, theme installation and a second weakness that could lead to code execution when an administrator opened the link.

Organizations unable to update immediately can close comments on individual posts or disable comments site-wide. A web application firewall or security plugin may block the crafted comment, although neither WordPress nor the researcher published a separate workaround. Patching does not reverse a successful compromise, so teams that suspect targeting should check for unrecognized plugins and files. The practical priority is to patch supported branches, reduce comment exposure until the update is complete, and review sites for unauthorized changes.