Security1 publisher2 min readPublished
WordPress patched a comment flaw that uses an admin's session to plant a web shell
CVE-2026-93485 was fixed on September 17 in WordPress 7.1.1. An anonymous comment plants a script, an administrator opens the page, and the script uploads a plugin carrying a web shell. Affected versions go back to 4.7.
The Watch · Security desk
What happened
- WordPress shipped the fix for CVE-2026-93485, nicknamed Comment2Shell, on September 17 in version 7.1.1, and told site owners to update right away.
- Patchstack, the company that assigned the identifier, scored the flaw 7.1 out of 10 on CVSS.
- An anonymous visitor's comment could reach the server only once a logged-in administrator opened the page, at which point the planted script used that session to upload a plugin containing a web shell.
- Affected versions run from 4.7 through 7.1, with fixed builds on each branch: 7.1.1, 7.0.5, 6.9.8, and back to 4.7.36 on the oldest branches still receiving security releases.
- Nobody has reported the flaw being used in an attack, and it is not on the U.S. government's list of actively exploited software flaws.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure The same comment also fires in ordinary readers' browsers, acting at each reader's own access level, so a site whose administrators never load the page still has script running against its visitors.
- decision A site that cannot patch today has to choose between turning comments off and trusting a firewall or security plugin to catch the crafted comment, because no separate workaround was published.
- constraint Patching stops the chain and leaves anything already installed in place, so an operator who suspects a hit still has to review plugins and files by hand before calling the site clean.
- precedent An administrator loading something is now the final step in two separate core chains fixed in the same release. Comment review and link clicks by privileged accounts count as exploit triggers.
WordPress sanitizes a comment when it saves it and reformats it when the page renders, and the bug lived in the gap between those two steps [4]. Rafie Muhammad, the researcher who reported it, put a line break inside the attribute of an allowed HTML tag, and published the full chain on September 21, four days after the fix shipped [5][2]. The save-time check let the comment through. One of the display-time formatting steps then split the tag apart and moved the attacker's text into a position where the browser read it as a live event handler. The handler ran as the page loaded, with no click required [6].
An administrator's pageview hands that script an administrator's session. The script uses the session to upload a plugin containing a web shell, the known route from an admin browser to control of the server [8].
The site has to render comments the way a block theme does, or use a classic theme that formats them the same way [9]. And the comment has to be on the page at all: WordPress described the flaw as exploitable only "subject to comment approval" [10]. Comment moderation is off by default, and the setting that holds a first-time commenter can be worked around [11]. Patchstack said: "moderation isn't a security control" [12].
Version 7.1.1 fixed 11 security problems [16]. The comment flaw was the only one an attacker with no account could reach, and most of the other ten required a logged-in user with some level of access [16][1]. The same release fixed Click2Shell, in which a crafted link could make WordPress install a theme and, together with a second weakness in that theme, run code on the server, again only if a logged-in administrator opened the link [17].
Core has produced cheaper routes than this one in 2026. In July a bug called wp2shell ran code with no login at all, and US authorities later listed it as used in real attacks [18]. In August researchers exploited a scripting flaw in the login page to execute code as an administrator [19]. Both are separate bugs from the comment flaw [19].
What to watch
- Addition of CVE-2026-93485 to the U.S. actively exploited catalog. That listing would attach a federal remediation deadline to a bug that currently has none.
- Public proof-of-concept code, or scanner traffic hitting comment forms on block-theme sites.
- Exploitation aimed at the stale branches, where the fix means installing a per-branch release as old as 4.7.36 rather than upgrading to 7.1.1.