Threat Intelligence

WordPress Fixes 'Comment2Shell' Flaw That Let Anonymous Comments Hijack Admin Sessions

The Hacker News · 22 Sept 2026

Key Takeaway Update WordPress to version 7.1.1 or later without delay, and review comment moderation settings so unapproved comments cannot be viewed by administrators before they are checked.

A newly disclosed WordPress core vulnerability, dubbed 'Comment2Shell' and tracked as CVE-2026-93485, allowed an anonymous site visitor to leave a comment containing a hidden script. The flaw exploited a gap between how WordPress checks comments for dangerous HTML when they are saved and how it reformats them for display, letting attackers sneak a live script past the filter using a specially placed line break in a comment's HTML.

Once planted, the script would run automatically in the browser of anyone who viewed the page. If that visitor happened to be a logged-in administrator, the script could use the admin's own session to upload a plugin containing a web shell, giving an attacker a path to run commands on the server itself. The issue affected sites using block themes, which includes every default WordPress theme since Twenty Twenty-Two, and classic theme sites with comment blocks on posts or pages. The attack also required the comment to be approved and displayed first.

WordPress addressed the flaw in version 7.1.1, released on September 17, and urged site owners to update immediately. Patchstack rated the issue 7.1 out of 10 on the CVSS severity scale. The researcher who reported it said he has not seen evidence of it being exploited in the wild, and it does not appear on the U.S. government's list of actively exploited vulnerabilities.

Summarised by CISO AI from The Hacker News. We link back to every original so you can read it yourself.