A single anonymous comment is enough to plant a script on a WordPress site and, if an administrator later opens that post, run code on the server. The flaw, named Comment2Shell and reported by security researcher Rafie Muhammad, was fixed in WordPress 7.1.1 on 17 September 2026.
Tracked as CVE-2026-93485 and rated 7.1 on the CVSS 3.1 scale, it is an unauthenticated stored cross-site scripting (XSS) bug in wpautop() — the core function that turns line breaks into paragraphs on nearly everything WordPress renders. WordPress cleans a comment when it is saved and reformats it when the page loads, and the bug lives in the gap between those two steps. The CVE record lists it as a DOM-based XSS, though WordPress and Patchstack describe it as a stored XSS.
How Comment2Shell Works
A visitor submits a comment holding a blockquote with a newline in its cite attribute. That input clears wp_kses(), WordPress’s comment sanitiser, because nothing in it looks dangerous. When the post displays, the formatting chain rearranges the markup, a faulty regular expression slips a paragraph tag inside the blockquote, and the once-harmless text becomes a live onfocus handler with autofocus. The script fires the moment the page loads — no clicking needed. In a logged-in admin’s session, it reads the plugin-installer nonce and uploads a PHP plugin, turning the XSS into full remote code execution.
Which Versions Are Affected and Is It Patched?
Every branch from 4.7 onward is vulnerable below its own fixed build. WordPress backported the fix down to 4.7.36. There is no sign of exploitation in the wild, and the bug is not on CISA’s KEV list — but update now.
Also Read
| Branch | Fixed build | Date |
|---|---|---|
| 7.1 | 7.1.1 | 17 Sep 2026 |
| 7.0 | 7.0.5 | 17 Sep 2026 |
| 6.9 | 6.9.8 | 17 Sep 2026 |
| 6.8 | 6.8.9 | 17 Sep 2026 |
| Oldest | 4.7.36 | 17 Sep 2026 |
Other Recent WordPress Core Flaws
The same 7.1.1 release also patched Click2Shell, a CSRF-to-selector-injection chain from pwn.ai’s Paulos Yibelo that lets one admin click force-install a theme and reach code execution — rated High alone and Critical (9.6) when chained. In August, WordPress 7.0.3 fixed XSS2Shell (CVE-2026-64638), a pre-auth login-screen XSS rated 8.9 that also escalates to PHP execution, while 7.0.2 closed WP2Shell (CVE-2026-60137 and CVE-2026-63030), an unauthenticated SQL-injection-to-RCE chain in the REST API.
Community Discussion
Join the conversation. Ask questions, share solutions, and help others.
Be the first to start the discussion!
