WordPress “Comment2Shell” XSS-to-RCE Chain Lets Unauthenticated Attackers Compromise Servers via Malicious Comments

What it is

CVE-2026-93485 (CVSS 7.1) is a stored XSS-to-RCE chain in WordPress Core's wpautop() function (wp-includes/formatting.php), exploitable by unauthenticated attackers through comments. The summary covers the shape; the page adds the trigger mechanism, the specific patch/backport versions, the config that lowers the exploitation bar, and the concrete mitigations for sites that cannot patch immediately.

How it works

The injection turns on a single character. An attacker submits an anonymous comment containing an HTML attribute with a > inside it. At display time, wpautop()'s regular expression misreads that > as a tag boundary, splits the tag apart, and relocates attacker-controlled text into a position the browser parses as executable JavaScript. Sanitization at save time and reformatting at display time disagree, which is what opens the gap. When a logged-in administrator views the page, the script runs with no click required, using the admin session to install a plugin carrying a web shell — full RCE.

Preconditions / Affected

• WordPress Core 4.7 through 7.1.0. Any content path through wpautop() is affected (comments, posts, other areas); block themes (all defaults since Twenty Twenty-Two) are confirmed affected.
• Comment moderation is on by default, but the barrier is lower than it looks: auto-approval is enabled for any user whose previous comment was approved, and some sites disable moderation entirely. Attack complexity is Low; only user interaction (an admin viewing the page) is needed.

What to do

• Upgrade to 7.1.1, or the branch backport: 7.0.5, 6.9.8, down to 4.7.36. Sites with automatic background updates enabled receive the patch automatically.
• 7.1.1 also fixes 10 additional vulnerabilities (path traversal, CSRF, more XSS) — treat it as a full security update, not a single-CVE patch.
• If you cannot patch now: disable comments site-wide, or require manual approval for all comments (not just first-time authors); deploy WAF rules to filter malicious comment payloads; and audit installed plugins for unexpected entries (the payload's persistence is a rogue plugin).

Caveats

At disclosure, no public PoC and no known in-the-wild exploitation; not listed on CISA KEV. The vendor still rates it high risk for internet-facing installs with comments enabled given the low complexity and unauthenticated initial vector.