Word Press Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session
Summary: A flaw in WordPress core tracked as CVE-2026-93485 and named Comment2Shell let an anonymous visitor plant a hidden script in a comment that ran when a logged-in administrator opened the page, and WordPress fixed it on September 17 in version 7.1.1. Patchstack rated it 7.1 out of 10 on CVSS, the affected versions run from 4.7 through 7.1, and there is no sign it has been used in attacks or that it is on the U.S. government's list of actively exploited flaws.
What's compelling: The chain ends with a web shell uploaded through the administrator's own session, and the researcher showed ways around the comment approval check that WordPress relied on - as Patchstack put it, "moderation isn't a security control." WordPress 7.1.1 fixed 11 security problems in all, and this was the only one reachable by an attacker with no account.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-93485
- Related
- ⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats Cyber Risks ·⚡ Weekly Recap: Net Scaler and Forti Mail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests Cyber Risks ·New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026