WordPress has released security updates to address a newly disclosed core vulnerability that could allow an anonymous visitor to plant a malicious script through the website comment system and potentially achieve remote code execution under specific conditions. Tracked as CVE-2026-93485 and named Comment2Shell, the flaw was resolved on September 17 with the release of WordPress 7.1.1. According to WordPress, administrators are encouraged to update their websites as soon as possible to reduce potential exposure. There is currently no indication that the vulnerability has been exploited in real world attacks, and it has not been added to the United States government list of actively exploited vulnerabilities. Patchstack, the security company that assigned the CVE identifier, rated the issue 7.1 out of 10 on the CVSS severity scale.
The vulnerability stems from the way WordPress processes comments before saving them and then reformats them again when displaying them on a webpage. Security researcher Rafie Muhammad, who reported the issue, explained in his technical analysis that a specially crafted line break placed within the attribute of an otherwise permitted HTML tag could alter how the comment is rendered in a browser. During page generation, WordPress could unintentionally restructure the HTML in a way that causes the injected content to be interpreted as an active event handler, allowing malicious JavaScript to execute automatically when the page loads. The script would run in the browser of anyone visiting the affected page, regardless of whether they were logged in. However, achieving remote code execution required an additional condition. A logged in administrator needed to open the page containing the crafted comment. In that situation, the malicious script could leverage the administrator’s authenticated session to upload a plugin containing a web shell, providing a possible path to server level access.
The attack scenario also depended on how comments were displayed by the website. According to the published research, websites using block themes, which have been the default since the Twenty Twenty Two theme, were affected, while certain classic themes, including Twenty Twenty One, could also be vulnerable if they processed comments through the same rendering mechanism. WordPress noted that exploitation is subject to comment approval because comments generally must appear on the page before any malicious code can execute. By default, comments submitted by new authors require moderation before publication. However, the researcher described methods that could allow specially crafted comments to reach publicly visible pages without relying on manual approval. Patchstack also emphasized that moderation should not be considered a security control because it is designed for content management rather than vulnerability prevention. Organizations unable to install updates immediately may temporarily reduce risk by disabling comments on posts or across the entire website, while web application firewalls and security plugins may help detect or block malicious comment submissions.
The security update addresses affected WordPress versions from 4.7 through 7.1, with fixes available for supported release branches, including WordPress 7.1.1, 7.0.5, and 6.9.8, while older supported branches have also received corresponding security releases. WordPress and the researcher both recommend updating to the latest available version because installing the patch removes the vulnerability but does not reverse any unauthorized changes that may already exist on a compromised website. Administrators who suspect suspicious activity are advised to inspect installed plugins and website files for unexpected additions. WordPress 7.1.1 also resolves ten additional security issues, although most require an authenticated user with some level of access. The release follows several significant WordPress security updates earlier this year, including Click2Shell, which involved a crafted link that could lead to server side code execution under specific conditions, the wp2shell vulnerability disclosed in July, and a separate login page scripting issue reported in August. WordPress noted that these are distinct vulnerabilities with different exploitation methods, reinforcing the importance of keeping WordPress core installations updated with the latest security releases.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
