Cybersecurity
WordPress fixes Comment2Shell remote code execution flaw
WordPress patched a core comment-handling flaw that could let a crafted comment become browser-side script and, if an administrator later viewed the page, lead to server-side code execution.
- WordPress fixed CVE-2026-93485, which it called Comment2Shell, in version 7.1.1 on 17 September and told site owners to update.
- WordPress said there was no sign of active abuse, and the flaw was not on the U.S. government's list of actively exploited software flaws.
- Patchstack assigned the identifier and rated the flaw 7.1 out of 10 on the CVSS scale.
- Rafie Muhammad said the problem arose between comment checking and later reformatting for display.
- Muhammad said a logged-in administrator who opened the page could have used their session to upload a plugin containing a web shell.
WordPress fixed CVE-2026-93485, which it called Comment2Shell, in version 7.1.1 on 17 September. It advised site owners to install the update and said it had found no sign of active abuse.
Patchstack assigned the identifier and gave the flaw a CVSS score of 7.1. Rafie Muhammad, who reported the bug, said the weakness sat between the step that checked a comment and the step that later reformatted it for display.
In Muhammad's account, a line break placed inside an allowed HTML tag could survive the first check and become script when the page rendered. The script could run in the browser of anyone who opened the page, and a logged-in administrator who did so could use their session to upload a plugin carrying a web shell.
WordPress said the issue depended on a comment reaching the page, while Muhammad described ways around moderation. The write-up said the bug affected block themes, including the default Twenty Twenty-Two setup, and also some classic themes such as Twenty Twenty-One.
The 7.1.1 release fixed 11 security issues in total. It also addressed Click2Shell, a separate flaw that could lead to code execution if an administrator opened a crafted link.
Named in this story
People
- Rafie Muhammad
- reported the bug and described the attack chain
Companies
- Patchstack
- assigned the identifier and scored the flaw
Products and systems
- WordPress
- fixed the flaw in core
- Comment2Shell
- the comment-handling flaw discussed in the article
- Twenty Twenty-Two
- the default block theme that was affected
- Twenty Twenty-One
- a classic theme named as also affected
- Click2Shell
- the second flaw fixed in the same release
- wp2shell
- a separate code-execution flaw mentioned for comparison
How the source tells it
The piece read as a plain technical advisory, with a short remediation section and little emotive framing.
No emotive framing was found in the original.