Back Cyberkendra WordPress Comment2Shell Flaw Turns Comments Into RCE
Comment2Shell (CVE-2026-93485) lets an anonymous WordPress reach RCE via an admin session. Fixed in 7.1.1 — update now.
Vivek is a staff writer and technology contributor at Cyber Kendra, covering the latest tech news, cybersecurity, and digital insights.
A single anonymous is enough to plant a script on a WordPress site and, if an administrator later opens that post, run code on the server. The flaw, named Comment2Shell and reported by security researcher Rafie Muhammad , was fixed in WordPress 7.1.1 on 17 September 2026.
Tracked as CVE-2026-93485 and rated 7.1 on the CVSS 3.1 scale, it is an unauthenticated stored cross-site scripting (XSS) bug in wpautop() — the core function that turns line breaks into paragraphs on nearly everything WordPress renders. WordPress cleans a when it is saved and reformats it when the page loads, and the bug lives in the gap between those two steps. The CVE record lists it as a DOM-based XSS, though WordPress and Patchstack describe it as a stored XSS.
How Comment2Shell Works
A visitor submits a holding a blockquote with a newline in its cite attribute. That input clears wp_kses() , WordPress’s sanitiser, because nothing in it looks dangerous. When the post displays, the formatting chain rearranges the markup, a faulty regular expression slips a paragraph tag inside the blockquote, and the once-harmless text becomes a live onfocus handler with autofocus . The script fires the moment the page loads — no clicking needed. In a logged-in admin’s session, it reads the plugin-installer nonce and uploads a PHP plugin, turning the XSS into full remote code execution.
Which Versions Are Affected and Is It Patched?
Every branch from 4.7 onward is vulnerable below its own fixed build. WordPress backported the fix down to 4.7.36. There is no sign of exploitation in the wild, and the bug is not on CISA’s KEV list — but update now.
Other Recent WordPress Core Flaws
The same 7.1.1 release also patched Click2Shell , a CSRF-to-selector-injection chain from pwn.ai’s Paulos Yibelo that lets one admin click force-install a theme and reach code execution — rated High alone and Critical (9.6) when chained. In August, WordPress 7.0.3 fixed XSS2Shell (CVE-2026-64638), a pre-auth login-screen XSS rated 8.9 that also escalates to PHP execution, while 7.0.2 closed WP2Shell (CVE-2026-60137 and CVE-2026-63030), an unauthenticated SQL-injection-to-RCE chain in the REST API.
Join the conversation. Ask questions, solutions, and help others.
Be the first to start the discussion!
Meta Announces Petal, a 1 Pbps Transatlantic Subsea Cable
CVE-2026-66804: Dark Elevator Fix Left Windows Exposed
Why Are Domain Renewal Fees So High? (And How to Pay Less)
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
