WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session
A crafted comment (Comment2Shell) allowed an attacker to run code on the server via a line break in an HTML attribute. Another flaw, Click2Shell, enabled theme installation and further code execution. WordPress has had…
Two separate security flaws: Comment2Shell allowing code execution via comments and Click2Shell enabling theme installation. These were patched in the latest WordPress releases and are considered exploitable issues.
- The comment flaw was exploited via a crafted link (Click2Shell) and a line break in an attribute (Comment2Shell).
- WordPress had multiple vulnerabilities including wp2shell and the Comment2Shell vulnerability.
- CVEs
- CVE-2026-93485
- ATT&CK
- T1566.001 Spearphishing AttachmentT1190 Exploit Public-Facing ApplicationT1486 Data Encrypted for Impact
- Vendors
- PatchstackMicrosoft
- Products
- WordPress coreWordPress plugin
- Threat actors
- an anonymous commenter
- Malware
- Comment2ShellClick2Shell
- Organizations
- a blogger named Swati Khandelwal
- Countries
- U.S.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-93485 | Unauthenticated Stored DOM-Based XSS in WordPress Core Affecting 4.7–7.0 | 7.1 | <1% | PoC ×3 |
From the original article
3 min read at thehackernews.com
A new flaw in WordPress core let an anonymous visitor leave a comment that planted a hidden script on the page. If a logged-in administrator later opened that page, the script could run code on the site's server. WordPress fixed the flaw, tracked as CVE-2026-93485 and dubbed "Comment2Shell," on September 17 in version 7.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.