WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session

1. Executive summary

WordPress core versions 4.7 through 7.1 contain a stored cross-site scripting flaw, CVE-2026-93485 ("Comment2Shell"), rated 7.1 HIGH (CVSS 3.x, Patchstack-assigned) and not listed in CISA KEV, with EPSS at 0% as of the verified reference data. An unauthenticated visitor can plant a script in a comment; when a logged-in administrator views the page, the script runs with the administrator's session and can upload a malicious plugin containing a web shell, giving the attacker code execution on the server. WordPress fixed the flaw in version 7.1.1, released 17 September 2026, and the researcher who reported it is not aware of in-the-wild exploitation. For EMEA financial services the exposure is limited to internet-facing WordPress sites, typically marketing and content properties rather than transaction systems, but a web shell on any public-facing server is a direct foothold for follow-on access and data theft.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The trigger facts here are a vendor patch release and an unexploited vulnerability with no observed incidents; a patch-available event does not on its own engage incident management, classification, or reporting duties under the articles in scope. Entities that discover actual compromise during the P2 review below should reassess against their own incident processes.

3. Technical analysis & attack chain

The vulnerability sits in the gap between two WordPress comment-handling steps: WordPress sanitises a comment for dangerous HTML when it is saved, then reformats it for display. The sanitisation and the display-time reformatting disagree on how a particular construct should be parsed, and the flaw lives in that disagreement.

Confirmed chain, as reported by researcher Rafie Muhammad in his 21 September write-up:

1. An anonymous visitor submits a comment containing an allowed HTML tag with a line break placed inside one of its attributes.
2. WordPress saves the comment after its HTML check passes, because the construct is inside an allowed tag.
3. When the page is rendered, WordPress's display-time reformatting breaks the tag apart and moves the attacker's text into a position the browser parses as a live event handler.
4. The event handler executes automatically on page load, with no click required by the viewer.
5. The script runs in the browser of whoever loads the page, at that person's access level, whether or not they are logged in.
6. If the viewer is a logged-in administrator, the script uses the administrator's own session to upload a plugin containing a web shell, which executes attacker-supplied commands on the server. Muhammad confirmed the full chain working end to end.

Conditions and scope:

• WordPress describes the flaw as exploitable only "subject to comment approval", but comment moderation is off by default and the first-time-commenter hold can be worked around, so a comment can reach the page unapproved. Patchstack's own framing: "moderation isn't a security control."
• The display path matters. The chain works on sites using a block theme; every default WordPress theme since Twenty Twenty-Two is a block theme. On a classic theme it works only on posts or pages that contain comment blocks.
• Affected versions run from 4.7 through 7.1. Fixed releases: 7.1.1, 7.0.5, 6.9.8, and the branch-specific fixed releases back to 4.7.36.

WordPress 7.1.1 fixed 11 security problems in total. Comment2Shell was the only one reachable by an attacker with no account; the others required an authenticated user with some level of access. The same release also fixed a second flaw, Click2Shell, in which a crafted link causes WordPress to install a theme and, combined with a second weakness in that theme, run code on the server; the source text is truncated before its full preconditions are given, so treat the Click2Shell detail as incomplete.

Caveats: the full technical write-up and the CVSS assignment come from a single researcher report and a single vendor (Patchstack), and the chain has no observed exploitation. The verified reference data records CWE-79 (cross-site scripting), which matches the source description; the source does not name a CWE, so there is no discrepancy to reconcile. No threat actor is named and no attribution claim exists to assess.

4. Mitigation & containment

P1, within 24 hours: inventory internet-facing WordPress instances, including marketing and content sites, and identify any running versions 4.7 through 7.1. Update to WordPress 7.1.1, or to the fixed release for the installed branch: 7.0.5 for 7.0, 6.9.8 for 6.9, and the branch-specific fixed release for older branches back to 4.7.36, per WordPress release documentation. No separate vendor workaround exists; updating is the fix.

P2, within 72 hours: for sites that cannot be updated immediately, close comments on affected posts or disable comments site-wide, and put a web application firewall or security plugin rule in front of the comment endpoint to block the crafted comment. Review recently approved and pending comments on block-theme sites for allowed-tag attributes containing embedded line breaks. On any site with reason to believe it was targeted, hunt for unrecognised plugins and files, since updating removes the flaw but does not undo changes an attacker already made.

P3, within 7 days: confirm all WordPress instances, including those on legacy branches, are on a fixed release or a branch that still receives security fixes; plan migration for branches that do not. Fold WordPress core version checks into routine external-facing asset review so unpatched instances surface before the next security release.

5. Indicators of compromise

No indicators of compromise available in the source material. The source describes no specific web shell file, plugin name, hash, domain, or IP associated with exploitation, and reports no observed attacks.

6. Detection

Insufficient indicators to author detection rules. The source provides no file artefacts, strings, command lines, registry keys, or network indicators belonging to a malicious payload; the only concrete artefact is the vulnerability mechanism itself, which is a patching matter rather than a detection signature.

CVE assessment

1 referenced CVE

7. Sources

• The Hacker News, "WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session", https://thehackernews.com/2026/09/wordpress-comment2shell-flaw-can-turn.html, 2026-09-22

8. Adverse Trace position

We assess this as a medium-severity exposure for EMEA financial services: the verified severity is 7.1 HIGH, but EPSS is 0%, the flaw is not in CISA KEV, and the researcher reports no known exploitation, so the near-term risk is opportunistic scanning after disclosure rather than active campaigns. The impact ceiling is high, since an administrator viewing one comment can hand over server code execution, and default settings leave the comment path open. The technical detail is single-sourced to the researcher's write-up and Patchstack's rating; verify the patch state of your own WordPress estate before treating any instance as safe. We will monitor for exploitation reports, CISA KEV listing, and any public proof-of-concept, and will reissue this advisory if the exploitation picture changes.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.