CVE-2026-93485

CVE

Threat entity extracted from intelligence sources

Frequency

4

occurrences

First Seen

September 22, 2026

Last Seen

September 22, 2026

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

WordPress Comment2Shell Vulnerability Allows RCE via Anonymous Comments64.5

A critical vulnerability in WordPress, tracked as CVE-2026-93485, allows unauthenticated users to execute remote code on servers through a crafted comment. This flaw, dubbed 'Comment2Shell,' enables attackers to insert malicious scripts that execute when a logged-in administrator views the comment....

Public Exploits

Checking GitHub for proof-of-concept code…

Related Clusters (1)

WordPress Comment2Shell Vulnerability Allows RCE via Anonymous Comments

2h ago·5 sources

Related Articles (4)

"moderation isn't a security control."

patchstack.com·2h ago

Comment2shell Zero Click Pre Auth Xss To Rce In Wordpress Core

idnsec.com·2h ago

WordPress Comment2Shell Flaw Turns Comments Into RCE

Cyberkendra·2h ago

WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session

Thehackernews·4h ago

Related Entities

Sql Injection CVE-2026-60137 CVE-2026-63030 CVE-2026-64638 CVE-2026-66804 Cwe-79 - Cross-site Scripting (xss)Cwe-89 - SQL Injection CWE-200 - Exposure of Sensitive Information CWE-22 - Path Traversal T1505.003 - Web Shell WordPress HTML