A Comment That Reads Differently Twice
WordPress has patched a core vulnerability dubbed "Comment2Shell", tracked as CVE-2026-93485, that turns an ordinary approved blog comment into a path to full server compromise. The bug, reported by security researcher Rafie Muhammad, is a gap between how WordPress validates a comment on submission and how it reformats that same comment for display.
The trick: an attacker embeds a line break inside an HTML tag attribute within a comment. Validation lets it through as harmless text. But when WordPress reformats the comment for rendering, the tag breaks apart, and the injected fragment lands in a position where the browser treats it as an active event handler — code that fires automatically, with no click, hover, or other interaction required.
From a Comment Box to a Web Shell
The flaw only matters once the comment is visible on a page a logged-in administrator opens — the comment has to be approved and displayed first. That makes it most effective on block themes (the default since WordPress Twenty Twenty-Two) and on classic themes that use comment blocks, since both render comment content in the vulnerable pattern.
Once an admin's browser loads the page, the injected script runs with the administrator's own access level — no separate authentication bypass needed. From there, the attack chain uploads a plugin packaged around a web shell, handing the attacker the ability to execute commands directly on the server. What started as a single blog comment ends as full remote code execution.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-93485 |
| CVSS Score | 7.1 (High) |
| Affected Versions | WordPress core 4.7 through 7.1 |
| Discovered By | Rafie Muhammad |
| Fixed In | 7.1.1, 7.0.5, 6.9.8, and branch-specific releases back to 4.7.36 |
| Patched | September 17, 2026 |
Who's Exposed
Affected: Any WordPress site on a version prior to the September 17, 2026 security release that allows comments and has at least one administrator who might open a page containing an unreviewed or recently approved comment — which describes the vast majority of active WordPress blogs.
Not affected once patched: Sites updated to 7.1.1 or the matching branch-specific security release.
Remediation
- Update WordPress immediately to 7.1.1, or the corresponding security release for your branch (7.0.5, 6.9.8, or the appropriate release back to 4.7.36) — there is no supported workaround short of patching.
- Review recently approved comments for suspicious HTML attributes or unexpected line breaks, particularly anything approved shortly before an unexplained change on the site.
- Audit installed plugins for anything unrecognized — the exploit chain's final step is a plugin upload, which leaves exactly that kind of artifact behind.
- Consider holding comments for moderation or disabling comments entirely on sites where administrators frequently browse public-facing pages while logged in, as a compensating control until you confirm the update is applied everywhere.