WordPress Comment2Shell flaw lets unauthenticated visitors run server code

Key points

• CVE-2026-93485 affects WordPress core through the Comment2Shell chain.
• An anonymous comment injects a hidden script; an admin page visit triggers execution.
• Successful exploitation yields remote code execution on the server.
• Version 7.1.1 is impacted; patching is advised immediately.

A newly disclosed flaw in WordPress core, designated CVE-2026-93485 and nicknamed Comment2Shell, chains a cross-site scripting weakness in comment handling with an administrator's browsing session. An unauthenticated visitor can leave a comment containing a concealed script; when a logged-in admin later opens a page that renders that comment, the script runs in the admin's browser context.

That script can then perform actions with the administrator's privileges, ultimately leading to remote code execution on the underlying server. The vulnerability is rated high severity because it requires no credentials to initiate and can compromise the whole site once an admin is lured into viewing the malicious comment.

The vulnerable release is version 7.1.1 of WordPress core, with the issue surfacing around September 17. Sites running that version and allowing comments are at risk. Because the attack begins with a simple anonymous comment, any public-facing WordPress installation with comments enabled is a potential target.

What to watch: indicators include unexpected admin page visits, unusual outbound connections, or modified files. Administrators should treat any suspicious comment as hostile until proven otherwise. The vendor has advised updating to a patched version; delaying leaves the door open for automated exploitation.

Context: Comment2Shell is notable because it turns a low-privilege input vector into full server compromise. It underscores the need for layered defenses—timely core updates, comment moderation, and monitoring for post-exploitation activity.

What to do now

1. Update WordPress core to the latest patched release immediately; version 7.1.1 is vulnerable.
2. If immediate patching isn't possible, disable comments or restrict comment posting to authenticated users.
3. Review and moderate all pending and recent comments for injected scripts or unusual markup.
4. Scan for indicators of compromise: unexpected admin sessions, new files, or outbound connections.
5. Enforce least privilege for admin accounts and consider using a web application firewall to block XSS payloads.
6. Monitor logs for admin page requests that correlate with comment submissions.
7. After patching, rotate admin credentials and salts/keys if compromise is suspected.

CVE references

• CVE-2026-93485

Original source

The Hacker News