idnsec.com WordPress Comment2Shell Vulnerability Allows RCE via Anonymous Comments
Article Content
- •CVE-2026-93485 allows RCE via anonymous comments on WordPress sites.
- •The vulnerability affects all versions from 4.7 to 7.1, requiring immediate updates.
- •No active exploitation has been reported, but the risk remains significant.
A critical vulnerability in WordPress, tracked as CVE-2026-93485, allows unauthenticated users to execute remote code on servers through a crafted comment. This flaw, dubbed 'Comment2Shell,' enables attackers to insert malicious scripts that execute when a logged-in administrator views the comment. The vulnerability arises from improper handling of HTML in the wpautop() function, which transforms line breaks into paragraphs. WordPress released a patch in version 7.1.1 on September 17, 2026, addressing this issue. The flaw affects all WordPress versions from 4.7 onward, with the patch backported to older versions. Although no active exploitation has been reported, site owners are urged to update immediately. The vulnerability has a CVSS score of 7.1, indicating a high severity level. Rafie Muhammad, the researcher who discovered the flaw, reported it through the WordPress bug bounty program.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (5)
Following this threat?
Track CVE-2026-93485 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical GitLab Vulnerabilities Exploited Within Hours of Disclosure On September 10, 2026, GitLab released patches for critical vulnerabilities CVE-2026-85706 and CVE-2026-87719. CVE-2026-85706, a path traversal flaw, allows unauthenticated users to read arbitrary files from GitLab servers, while CVE-2026-87719 enables credential theft via insecure deserialization. Both…