Full Report
A new flaw in WordPress core let an anonymous visitor leave a comment that planted a hidden script on the page. If a logged-in administrator later opened that page, the script could run code on the site's server. WordPress fixed the flaw, tracked as CVE-2026-93485 and dubbed "Comment2Shell," on September 17 in version 7.1.1 and told site owners to update right away. There is
Analysis Summary
# Vulnerability: Comment2Shell (WordPress Core XSS-to-RCE)
## CVE Details
- **CVE ID:** CVE-2026-93485
- **CVSS Score:** 7.1 (High)
- **CWE:** Not explicitly listed (Involves Cross-Site Scripting [CWE-79] leading to Remote Code Execution)
## Affected Systems
- **Products:** WordPress Core
- **Versions:** 4.7 through 7.1
- **Configurations:** Sites using "Block themes" or "Classic themes" that format comments via the vulnerable core mechanism. The vulnerability is highly potent if comment moderation is disabled (default) or bypassed.
## Vulnerability Description
Comment2Shell is a Stored Cross-Site Scripting (XSS) vulnerability that arises from a discrepancy in how WordPress handles HTML attributes in comments. An attacker can inject a line break within an allowed HTML tag's attribute. While WordPress sanitizes the comment upon saving, the subsequent reformatting process for display breaks the tag, causing the browser to interpret the attacker's injected text as a live JavaScript event handler.
The payload executes automatically upon page load (Zero-click). If the script executes in the session of a logged-in administrator, it can programmatically upload a malicious plugin containing a web shell, effectively upgrading the XSS to Remote Code Execution (RCE).
## Exploitation
- **Status:** PoC documented by researcher Rafie Muhammad; no current signs of exploitation in the wild.
- **Complexity:** Medium (Requires specific formatting and an administrator to view the page).
- **Attack Vector:** Network (Remote, anonymous).
## Impact
- **Confidentiality:** High (Full server access via web shell).
- **Integrity:** High (Ability to modify site content, plugins, and core files).
- **Availability:** High (Potential for site takeover or deletion).
## Remediation
### Patches
Update to the following versions immediately:
- **WordPress 7.1:** Update to **7.1.1**
- **WordPress 7.0:** Update to **7.0.5**
- **WordPress 6.9:** Update to **6.9.8**
- **Older Branches:** Apply security releases for your specific branch (e.g., 4.7.36 for the 4.7 branch).
### Workarounds
- **Disable Comments:** Completely disable comments or close comments on all existing posts.
- **WAF/Security Plugins:** Implement a Web Application Firewall (WAF) to filter crafted HTML tags containing line breaks in attributes.
- **Strict Moderation:** While not a primary security control, enabling strict "must be manually approved" settings for all comments may slow an attack.
## Detection
- **Indicators of Compromise:**
- Presence of unknown or suspicious plugins in the `/wp-content/plugins/` directory.
- Unexpected files (web shells) in the `/wp-content/uploads/` or plugin directories.
- Comments containing HTML tags with unusual line breaks inside attributes.
- **Detection Methods:** Audit site logs for administrative actions (like plugin uploads) performed at times when the administrator did not manually perform them.
## References
- **Vendor Advisory:** hxxps[://]wordpress[.]org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/
- **Researcher Write-up:** hxxps[://]idnsec[.]com/research/comment2shell-zero-click-pre-auth-xss-to-rce-in-wordpress-core/
- **Patchstack Analysis:** hxxps[://]patchstack[.]com/articles/wordpress-7-1-1-maintenance-and-security-release/
- **CVE Link:** hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-93485