WordPress patched a comment flaw that uses an admin's session to plant a web shell
CVE-2026-93485 was fixed on September 17 in WordPress 7.1.1. An anonymous comment plants a script, an administrator opens the page, and the script uploads a plugin carrying a web shell. Affected versions go back to 4.7.
The Watch · Security desk
What happened
- WordPress shipped the fix for CVE-2026-93485, nicknamed Comment2Shell, on September 17 in version 7.1.1, and told site owners to update right away.
- Patchstack, the company that assigned the identifier, scored the flaw 7.1 out of 10 on CVSS.
- An anonymous visitor's comment could reach the server only once a logged-in administrator opened the page, at which point the planted script used that session to upload a plugin containing a web shell.
- Affected versions run from 4.7 through 7.1, with fixed builds on each branch: 7.1.1, 7.0.5, 6.9.8, and back to 4.7.36 on the oldest branches still receiving security releases.
- Nobody has reported the flaw being used in an attack, and it is not on the U.S. government's list of actively exploited software flaws.
Why it matters
- Who's exposed exposure The same comment also fires in ordinary readers' browsers, acting at each reader's own access level, so a site whose administrators never load the page still has script running against its visitors.
- Who has to decide decision A site that cannot patch today has to choose between turning comments off and trusting a firewall or security plugin to catch the crafted comment, because no separate workaround was published.
- What it limits constraint Patching stops the chain and leaves anything already installed in place, so an operator who suspects a hit still has to review plugins and files by hand before calling the site clean.
- What it sets up precedent An administrator loading something is now the final step in two separate core chains fixed in the same release. Comment review and link clicks by privileged accounts count as exploit triggers.
Next story · Security · 4d ago
Bricksforge's unauthenticated upload flaw is being used to run PHP on WordPress sitesConfirmed3 publishers
WordPress sanitizes a comment when it saves it and reformats it when the page renders, and the bug lived in the gap between those two steps [6]. Rafie Muhammad, the researcher who reported it, put a line break inside the attribute of an allowed HTML tag, and published the full chain on September 21, four days after the fix shipped [20][21]. The save-time check let the comment through. One of the display-time formatting steps then split the tag apart and moved the attacker's text into a position where the browser read it as a live event handler. The handler ran as the page loaded, with no click required [7].
An administrator's pageview hands that script an administrator's session. The script uses the session to upload a plugin containing a web shell, the known route from an admin browser to control of the server [8].
The site has to render comments the way a block theme does, or use a classic theme that formats them the same way [2]. And the comment has to be on the page at all: WordPress described the flaw as exploitable only "subject to comment approval" [9]. Comment moderation is off by default, and the setting that holds a first-time commenter can be worked around [19]. Patchstack said: "moderation isn't a security control" [10].
Version 7.1.1 fixed 11 security problems [13]. The comment flaw was the only one an attacker with no account could reach, and most of the other ten required a logged-in user with some level of access [13][18]. The same release fixed Click2Shell, in which a crafted link could make WordPress install a theme and, together with a second weakness in that theme, run code on the server, again only if a logged-in administrator opened the link [15].
Core has produced cheaper routes than this one in 2026. In July a bug called wp2shell ran code with no login at all, and US authorities later listed it as used in real attacks [16]. In August researchers exploited a scripting flaw in the login page to execute code as an administrator [17]. Both are separate bugs from the comment flaw [17].
What to watch
- Addition of CVE-2026-93485 to the U.S. actively exploited catalog. That listing would attach a federal remediation deadline to a bug that currently has none.
- Public proof-of-concept code, or scanner traffic hitting comment forms on block-theme sites.
- Exploitation aimed at the stale branches, where the fix means installing a per-branch release as old as 4.7.36 rather than upgrading to 7.1.1.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+20
- Incentives45
- Confidence58
Perspective Coverage
5 publishers- Builder
- Builder 29%
- Operator
- Operator 64%
- Investor
- Investor 7%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
WordPress fixed the flaw, tracked as CVE-2026-93485 and dubbed "Comment2Shell", on September 17 in version 7.1.1, and told site owners to update right away.
- [2]
The attack worked on sites that use a block theme, or a classic theme that formats comments the same way, and not on others.
- [3]
The affected versions run from 4.7 through 7.1; fixed releases are 7.1.1 for the 7.1 branch, 7.0.5 for 7.0, 6.9.8 for 6.9, and for older branches back to 4.7 the per-branch fixed release as far back as 4.7.36.
- [4]
Patchstack, the company that assigned the identifier, rated the flaw 7.1 out of 10 on the CVSS scale.
- [5]
There is no sign the flaw has been used in attacks, and it is not on the U.S. government's list of actively exploited software flaws.
- [6]
WordPress checks a comment for dangerous HTML when it is saved, then reformats it when the page is shown, and the flaw sat in the gap between those two steps.
- [7]
When WordPress reformatted the comment for display, one of its steps broke that tag apart and moved the attacker's text into a spot where the browser treated it as a live event handler, and the handler ran automatically as the page loaded, with no click required.
- [8]
Running code on the server needed a logged-in administrator to open the page carrying the comment; the script could then use the administrator's own session to upload a plugin containing a web shell, and uploading a plugin this way is a known route from an administrator's browser to control of the server.
- [9]
WordPress described the flaw as exploitable only "subject to comment approval".
- [10]
Patchstack said: "moderation isn't a security control".
- [11]
A site that cannot update at once can close comments on posts or turn comments off across the site, and a web application firewall or security plugin may block the crafted comment; neither WordPress nor the researcher published a separate workaround.
- [12]
Updating fixes the flaw but does not undo any change an attacker already made, and a site with reason to think it was targeted should also look for plugins or files it does not recognize.
- [13]
WordPress 7.1.1 fixed 11 security problems in all; the comment flaw was the only one that an attacker with no account could access, and most of the others required a logged-in user with some level of access.
- [14]
The script ran in the browser of whoever opened the page, whether or not they were logged in, and it acted with that person's access level to the site.
- [15]
The same release fixed a second flaw, called Click2Shell, in which a crafted link could make WordPress install a theme and, together with a second weakness in that theme, run code on the server; it too required a logged-in administrator to open the link.
- [16]
In July, a bug called wp2shell let attackers run code with no login at all, and U.S. authorities later listed it as used in real attacks.
- [17]
In August, researchers exploited a scripting flaw in the WordPress login page to execute code as an administrator; the July and August bugs are separate flaws from the comment bug.
- [18]
Besides the comment flaw, WordPress 7.1.1 carried 10 other security fixes.
- [19]
Comment moderation is off by default, and the setting that holds a first-time commenter can be worked around, so a comment could reach the page without anyone approving it.
- [20]
Rafie Muhammad, the security researcher who reported the bug, laid out the full chain in a write-up on September 21; the trick was a line break placed inside the attribute of an allowed HTML tag in the comment.
- [21]
The researcher's write-up came four days after the fix shipped.
Sources
5 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comHackers start exploiting critical WordPress flaw for code execution
1 article · September 23, 2026
- helpnetsecurity.comWordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)
1 article · September 23, 2026
- orca.securityWordPress “Comment2Shell” XSS-to-RCE Chain Lets Unauthenticated Attackers Compromise Servers via Malicious Comments
1 article · September 22, 2026
- securityaffairs.comCVE-2026-87902: how close is your WordPress to remote code execution?
1 article · September 23, 2026
- thehackernews.comWordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session
3 articles · September 22, 2026
Topics and entities
Topics
- Cross-Site Scripting
- Remote Code Execution Surfaces
- Content management systems
- Web Application Security