WordPress Patch Fixes Comment-to-Server Code Execution Flaw

A newly patched vulnerability in WordPress core allowed anonymous visitors to plant hidden scripts through standard comments. If a site administrator later viewed that page, the script could execute code directly on the server, granting attackers full control over the site.

The flaw, identified as CVE-2026-93485 and dubbed "Comment2Shell," was fixed in version 7.1.1 released on September 17. While no active exploitation has been confirmed yet, the security risk is significant because it bypasses traditional login requirements to reach critical system functions.

Comment Handling Gap Enables Code Execution

The vulnerability existed in the gap between how WordPress saved comments and how it displayed them. A security researcher named Rafie Muhammad detailed the exploit, which used a specific line break inside an allowed HTML tag to trick the browser into running a live event handler when the page loaded.

This script ran in the browser of anyone who opened the page, acting with their specific access level. To achieve server-side code execution, a logged-in administrator had to view the comment. The script then used the admin's session to upload a malicious plugin, effectively turning a simple comment into a backdoor.

Moderation Settings Do Not Prevent Exploitation

The attack relies on comments appearing on the page, but default WordPress settings often allow this without manual approval. Patchstack, which assigned the vulnerability identifier, noted that comment moderation is not a reliable security control. Attackers can bypass hold settings to ensure the malicious comment is visible to administrators.

The flaw affects sites using block themes or classic themes that format comments in a specific way. The exploit requires no prior account for the attacker, making it a significant threat to any site that leaves comments open, even if they believe their moderation settings are strict.

Immediate Update Required for All Versions

Site owners must update to WordPress 7.1.1 or the latest fixed version for their specific branch, ranging back to 4.7.36. The Hacker News reported that this was the only flaw in the 7.1.1 release accessible without an account, though the same update also fixed a related issue called Click2Shell that required an admin to click a crafted link.

Updating fixes the code vulnerability but does not reverse any changes an attacker may have already made. Administrators should immediately check for unrecognized plugins or files on their servers. If an update is not possible, disabling comments entirely is the only recommended temporary mitigation.