A newly patched WordPress core vulnerability could allow an unauthenticated attacker to plant malicious code through the platform’s comment system, potentially putting vulnerable websites at risk of server compromise.
The security flaw, tracked as CVE-2026-93485 and nicknamed “Comment2Shell,” affects the way WordPress processes and displays certain HTML inside comments. An attacker could submit a specially crafted comment containing hidden JavaScript. When a logged-in administrator later viewed the affected page, the malicious script could execute automatically without requiring the administrator to click anything.
Researchers found that the vulnerability stems from a difference between how WordPress sanitizes a comment when it is submitted and how that same content is reformatted when displayed. By inserting a carefully positioned line break inside an allowed HTML attribute, an attacker could manipulate the formatting process and cause previously filtered content to become an executable browser event handler.
The attack becomes particularly dangerous because malicious JavaScript running within an administrator’s authenticated session could potentially be used as part of a chain leading to remote code execution (RCE) on the WordPress server.
WordPress addressed Comment2Shell on September 17, 2026, with the release of WordPress 7.1.1. Patchstack assigned the vulnerability a CVSS severity score of 7.1 out of 10. As of the disclosed research, there was no evidence that CVE-2026-93485 had been exploited in real-world attacks.
WordPress administrators should update to the latest supported version immediately, review website comments for suspicious HTML, maintain reliable backups, and continue monitoring administrator activity for unexpected changes.