HackerFeeds

CyberSecurity News

WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session

The Hacker News
· September 22, 2026
Vulnerabilities

AI summary

A vulnerability in WordPress core allowed an anonymous visitor to leave a comment that embedded a hidden script on the page. If an administrator later viewed the page while logged in, the script could execute code on the site's server, potentially leading to remote code execution. The flaw, known as Comment2Shell, was addressed by WordPress in version 7.1.1, released on September 17. WordPress has advised site owners to update immediately to fix the issue, which is tracked as CVE-2026-93485. The vulnerability enabled an escalation from cross-site scripting to remote code execution via an admin session. WordPress has taken steps to mitigate the flaw by releasing an updated version.

Vulnerabilities mentioned

CVE-2026-93485
HIGH
CVSS 7.1

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Automattic WordPress core allows DOM-Based XSS. This issue affects WordPress versions 7.1 before 7.1.1; 7.0 through 7.0.4; 6.9 through 6.9.7; 6.8 through 6.8.8; 6.7 through 6.7.7; 6.6 through 6.6.7; 6.5 through 6.5.10; 6.4 through 6.4.10; 6.3 through 6.3.10; 6.2 through 6.2.11; 6.1 through 6.1.12; 6.0 through 6.0.14; 5.9 through 5.9.16; 5.8 through 5.8.15; 5.7 through 5.7.17; 5.6 through 5.6.19; 5.5 through 5.5.20; 5.4 through 5.4.21; 5.3 through 5.3.23; 5.2 through 5.2.26; 5.1 through 5.1.24; 5.0 through 5.0.27; 4.9 through 4.9.31; 4.8 through 4.8.30; and 4.7 through 4.7.35. The Unauthenticated Stored XSS vulnerability in the WordPress core can be reproduced on a default WordPress installation. Comment moderation is disabled by default, and the requirement for commenters to have a previously approved comment can be bypassed.

Read the full article at The Hacker Newsthehackernews.com/2026/09/wordpress-comment2shell-flaw-can-turn.html

This is an AI-generated brief aggregated by HackerFeeds for convenience and grounded in the source’s own summary; the related CVE, threat-group and country data is from HackerFeeds’ own indexes. The original article is the authoritative source — all rights belong to The Hacker News.