WordPress Comment2Shell Vulnerability Lets Hackers Take Over Sites Through Comments

WordPress administrators are being urged to patch a high-severity core vulnerability that can turn an anonymous comment into server-side command execution.

Tracked as CVE-2026-93485 and demonstrated by the Comment2Shell proof-of-concept, the flaw is an unauthenticated stored cross-site scripting issue in WordPress’s wpautop() formatting function. WordPress fixed the vulnerability in version 7.1.1 and advised site owners to update immediately.

Comment2Shell shows how apparently harmless markup can become executable only when WordPress renders a stored comment. A crafted newline inside the cite attribute of an allowed blockquote element survives the initial KSES sanitization.

During display, wpautop() replaces that newline with an HTML-comment placeholder, while a faulty regular expression stops at the first closing angle bracket and inserts a paragraph element inside the attribute.

Subsequent formatting causes the browser to interpret attacker-controlled onfocus and autofocus attributes, triggering JavaScript automatically when the page loads.

The resulting XSS runs with the privileges of the person viewing the post. If that visitor is a logged-in administrator, the payload can access WordPress administrative functions, retrieve the plugin-installation nonce, construct a ZIP archive in the browser, and upload a webshell disguised as a plugin.

The proof-of-concept published by Syed Wajeeh-ul-Hassan Rizvi then executes a command and removes the PHP shell and plugin directory, reducing obvious traces. No attacker account or pre-obtained nonce is required, although a privileged administrator must view the affected post.

Successful exploitation also depends on comments being enabled, anonymous submissions being accepted, and the malicious comment becoming visible.

The demonstrated chain relies on block-theme rendering behavior; classic themes may not trigger the same attribute transformation. Comment approval can limit immediate exposure, but it should not be treated as a security boundary because previously approved identities and preview behavior may allow crafted content to appear.

CVE-2026-93485 carries a CVSS 3.1 score of 7.1 and affects WordPress releases from 4.7 through 7.1.0, with branch-specific patched builds extending back to 4.7.36.

Rafie Muhammad of Awesome Motive reported the underlying wpautop() vulnerability through WordPress’s coordinated disclosure process; the Comment2Shell project packages the independently discovered issue into a dependency-free Python scanner, laboratory environment, exploit demonstration, Nuclei template, and IOC checker.

Defenders should upgrade to WordPress 7.1.1 or the newest patched release available for their maintained branch. They should also inspect the wp_comments database for unusual blockquote, cite, onfocus, or autofocus combinations; review requests to wp-comments-post.php and wp-admin/update.php; and hunt for recently created, unfamiliar PHP files under wp-content/plugins

Until patching is complete, disabling comments can reduce exposure. Any suspicious plugin upload should trigger incident-response review of administrator sessions, files, logs, credentials, and persistence mechanisms.

At disclosure, researchers had not reported active exploitation, but the public proof-of-concept lowers the barrier for replication. Organizations should prioritize sites and treat unexplained comment activity or plugin directories as evidence of compromise.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC