WordPress released version 7.1.1 on September 17, 2026, patching CVE-2026-93485, a critical vulnerability dubbed “Comment2Shell” that allows an anonymous visitor to leave a comment containing a hidden XSS script that executes when a logged-in administrator views the comment page, achieving remote code execution on the server.
Vulnerability details were publicly disclosed on September 22, 2026, five days after the patch. The attack chain progresses from anonymous comment submission to admin session hijack to full server compromise. All WordPress sites running versions prior to 7.1.1 are affected.
CVE-2026-93485 Enables Anonymous Comment to RCE Attack Chain
The Comment2Shell vulnerability allows any anonymous visitor to leave a comment on a WordPress site. The comment contains a hidden XSS (cross-site scripting) payload that does not appear malicious to visual inspection or basic content filtering.
When a logged-in administrator views the comment moderation page or the post where the comment was submitted, the XSS script executes in the administrator’s browser session. The script runs with the administrator’s privileges, granting it access to WordPress administrative functions.
XSS Executes in Admin Session, Escalates to Server-Side Code Execution
The XSS payload’s execution in an administrator’s browser session is the first stage of the attack. The script can invoke WordPress administrative APIs, install plugins, modify theme files, or create new administrator accounts—all actions available to a logged-in administrator.
Comment2Shell’s exploitation path uses the admin session to achieve remote code execution on the server. The script can upload a malicious plugin or modify a PHP file in the WordPress installation, embedding a web shell or backdoor. Once the server-side code is in place, the attacker has persistent RCE capability independent of the initial XSS trigger.
The critical escalation occurs because WordPress administrators have the ability to edit theme files and install plugins, actions that inherently involve writing PHP code to the server filesystem. The XSS script automates these actions, turning an admin’s legitimate privileges into an attack vector.
WordPress Released Version 7.1.1 Patch on September 17
WordPress issued version 7.1.1 on September 17, 2026, containing the fix for CVE-2026-93485. The patch addresses the comment handling flaw that allowed anonymous visitors to inject XSS payloads into comments in a manner that bypassed WordPress’s content sanitization.
The September 17 release predates the public disclosure of vulnerability details by five days. WordPress followed a coordinated disclosure timeline, releasing the patch before attackers had access to detailed exploitation instructions.
Vulnerability Details Publicly Disclosed September 22
Full technical details of Comment2Shell were disclosed on September 22, 2026. The publication included the attack chain mechanics—how to craft the malicious comment, the XSS payload structure, and the escalation to RCE through admin session abuse.
The five-day gap between patch release and public disclosure provided a window for site administrators to update before exploitation details became widely available. However, organizations that did not apply the September 17 update now face active risk, as attackers can replicate the attack using the published details.
All WordPress Sites Pre-7.1.1 Vulnerable to Anonymous Comment Exploit
Comment2Shell affects every WordPress installation running a version prior to 7.1.1. The vulnerability exists in WordPress core, not in a plugin or theme, meaning every site is exposed regardless of its configuration or installed extensions.
The anonymous nature of the attack eliminates authentication barriers. An attacker does not need a user account, moderation approval bypass, or elevated privileges. They submit a comment as an unauthenticated visitor, and the payload activates when an administrator views the comment queue.
Site Owners Must Upgrade to Version 7.1.1 Immediately
WordPress site administrators must update to version 7.1.1 immediately. The critical severity of the vulnerability—anonymous commenter to full server compromise—tolerates no delay. Sites with automatic updates enabled received the patch on September 17; manually managed sites require immediate administrator action.
After upgrading, site administrators should review comment moderation queues for suspicious comments submitted between September 17 and the date of patching. Comments containing obfuscated JavaScript, unusual HTML entities, or encoded content should be flagged for inspection.
Administrators should also audit installed plugins, theme files, and uploaded files for unauthorized modifications. If an attacker exploited Comment2Shell before the patch was applied, they may have installed a backdoor, created a rogue administrator account, or modified PHP files to maintain persistent access.
Implications for WordPress Comment Handling and XSS Defense
Comment2Shell highlights the difficulty of sanitizing user-submitted content in complex web applications. WordPress processes millions of comments daily, and the comment system must balance spam filtering, malicious content detection, and legitimate user expression.
The vulnerability’s progression from XSS to RCE depends on WordPress’s administrative privilege model. Administrators can edit code files directly from the web interface, a feature designed for convenience but one that converts XSS in an admin context into a critical RCE risk.
Other content management systems with similar admin-accessible code editing features face analogous risks. An XSS vulnerability that executes in an administrator’s session becomes an RCE vulnerability if the admin can write code to the server filesystem through the CMS interface.
WordPress’s rapid patch release and coordinated disclosure demonstrate effective vulnerability handling. The five-day window between fix and public disclosure gave site administrators time to update before attackers had detailed exploitation guides. Organizations that monitor WordPress security advisories and apply updates promptly benefited from this timeline.
However, the public disclosure on September 22 means exploitation attempts will increase as attackers incorporate Comment2Shell into automated scanning and exploitation tools. WordPress sites that remain unpatched face imminent compromise risk, as the attack requires only the ability to submit an anonymous comment and wait for an administrator to view it.
