Script code placed inside an ordinary blog comment could run in a logged-in administrator’s browser, then use that person’s session to drop a web shell onto the site.
Version 7.1.1, released on September 17, closed 11 security problems in total, and this was the only one an attacker with no account could reach. The bug is tracked as CVE-2026-93485 and nicknamed Comment2Shell. Patchstack, which assigned the identifier, gives it 7.1. Nothing suggests attackers have used it, and CISA’s exploited-vulnerability catalog does not list it.
The rewrite that broke a tag
Defenders should read the patch notes closely. WordPress screens a comment when it is saved, then regenerates the same text when it is displayed, and the defect sat in that second regeneration step. A line break inserted into an attribute of a permitted tag made the tag fracture mid-rebuild, leaving the attacker’s payload in a position the browser treated as a live event handler. Loading the page was enough to start it.
Only a logged-in administrator opening the affected page could turn that browser-side run into server-side control, at which point the script inherited the administrator’s session and could install a plugin carrying a web shell.
Moderation will not save you
Whether the trick lands depends on how a site renders comments. Block themes, standard since Twenty Twenty-Two, fall in scope, as do some classic themes including Twenty Twenty-One. WordPress frames Comment2Shell as exploitable only where a comment clears moderation. Rafie Muhammad, who reported the bug, showed that step can be sidestepped, and Patchstack’s summary is blunter still: moderation is not a security control.
Every release from 4.7 through 7.1 is affected. Fixed builds run from 7.1.1 back to 4.7.36, and a site that cannot patch right away should turn comments off and watch for unrecognised plugins or files.
