WordPress Patches Comment2Shell, a Comment Flaw That Can Lead to Server Takeover

WordPress released version 7.1.1 on 17 September 2026, and it is not the routine maintenance update its version number suggests. The release carries eleven security fixes alongside its bug fixes, and the most serious of them is a stored cross-site scripting flaw that an anonymous visitor can trigger through an ordinary comment. The vulnerability, tracked as CVE-2026-93485, has been nicknamed Comment2Shell because of where it can lead: from a comment in a moderation queue to code running on the server.

Related reading: Check Point Patches Two 9.8-Severity VPN Flaws That Allow Unauthenticated Code Execution · SAP Patches a CVSS 10.0 Kernel Flaw That Requires No Credentials.

The flaw sits in wpautop(), the WordPress function that converts line breaks in text into paragraph markup. WordPress runs comment text through it before display, and the bug allows a visitor with no account to plant script that passes the site's comment sanitizer, wp_kses(), because nothing in the payload looks like the markup the sanitizer exists to strip. The script only becomes dangerous later, when the comment is rendered and the display filters rearrange the text.

The vulnerability was reported by security researcher Rafie Muhammad of Awesome Motive through Patchstack's vulnerability disclosure program on 15 September 2026. WordPress shipped the fix two days later, and Patchstack published it to its database on 18 September. The full release included 17 core bug fixes and 21 block editor fixes in addition to the security work.

What makes this one different

WordPress ships security fixes regularly, and most of them require some level of access to exploit. This one does not. CVE-2026-93485 is rated 7.1 on the CVSS 3.1 scale, with a vector of network-reachable, low complexity, no privileges required, and a requirement that someone view the payload. It is the only one of the eleven issues in the release that an attacker with no account can reach; most of the others require a logged-in user with at least contributor-level access.

Patchstack's analysis is blunt about the moderation safeguard. WordPress's release notes describe the flaw as subject to comment approval, which sounds reassuring. The CVE record is less so: it says the issue reproduces on a default installation because manual comment moderation is off by default, and because the setting that holds a first-time commenter for review can be bypassed. That means a payload can reach the moderation queue on a stock site, and an attacker who has had a comment approved before is auto-approved from then on.

The reason a comment bug matters more than it first appears is who reads comments. Visitors see them, but so do moderators and administrators. A script running in an administrator's logged-in browser can act with that administrator's permissions, and from there an attacker can create a new administrator account and use it to run code on the server. The name Comment2Shell describes that chain rather than the comment itself.

The gap between sanitizing and rendering

The flaw is an illustration of why input filtering is hard. WordPress cleans a comment when it is saved, using wp_kses() to strip anything that looks like executable markup, and then reformats it when the page loads, using wpautop() to turn line breaks into paragraphs. The vulnerability lives in the space between those two steps. A payload that passes the sanitizer is not dangerous on its own; it becomes dangerous when the display filter rearranges the text and the browser interprets the result as a tag.

Patchstack's analysis shows the fix makes the expression in wpautop() aware of quoting, so a closing angle bracket inside a quoted value is no longer read as the end of a tag. The change is small, which is typical of cross-site scripting fixes and also why they are easy to miss in review. The lesson security teams draw from bugs like this is that sanitizing and rendering have to agree on what the input means, and that any mismatch between the two is a potential execution path.

Who is affected and how to fix it

Every WordPress branch from 4.7 onward is vulnerable below its own fixed build. WordPress backported the fix across the supported branches, and the fixed releases for the current lines are 7.1.1 for the 7.1 branch, 7.0.5 for 7.0 and 6.9.8 for 6.9. Older branches, back to 4.7.36, received their own patched builds. The project recommends updating immediately and notes that sites with automatic background updates enabled will pick the fix up on their own.

For administrators who cannot update at once, the practical mitigation is to change the conditions the exploit depends on. Turning on manual comment moderation puts a human between an anonymous comment and the page, and closing comments on older posts removes the entry point entirely. Neither is a substitute for patching, and Patchstack's note that the previously-approved-commenter safeguard can be bypassed means moderation only helps if moderators approve comments they recognise as genuine.

The other fixes in the release are worth having on their own. They include a contributor-level flaw that let an authenticated user overwrite posts they did not own, an authenticated path traversal in the REST templates controller reported by Anthropic, and several issues in the HTML API and theme handling. None of them is as broadly reachable as the comment flaw, and all of them are addressed by the same update.

A familiar pattern, with a sharper edge

The release continues a difficult year for WordPress core security. In July, a flaw called wp2shell allowed attackers to run code with no login at all, and US authorities later listed it as exploited in real attacks. In August, researchers disclosed a scripting flaw in a different component. Comment2Shell is a separate bug with a separate fix, and its reachability by an unauthenticated visitor puts it in the same uncomfortable category as those earlier issues.

What distinguishes this one is the escalation path rather than the entry point. Cross-site scripting in comments is an old problem, and the standard advice has been to moderate comments and keep the software current. The interesting part of Comment2Shell is that the payload survives the sanitizer and then converts a routine administrative action, opening a comment, into a step toward server compromise. That is a reminder that the security of a content management system depends on the least privileged action it invites, not only on the parts that face the internet directly.

The bug is also a small case study in disclosure. Muhammad reported it through a coordinated program, WordPress fixed it within two days, and Patchstack published the details a day after the release. That is the process working. The same process means the details are now public, and the fix is the only defence, which is why researchers described the update as urgent rather than advisable.

The practical lesson is that a routine comment form is a security surface. Sites that keep comments open on old posts, or that auto-approve commenters who have posted before, should treat the moderation queue as an entry point and update without waiting for a maintenance window. Managed hosts that run many installs can also check whether any are pinned to an unsupported branch, because backports only help the sites that apply them.

What to watch

The immediate question is how quickly the long tail of WordPress sites updates. WordPress powers a large share of the web, and many installs are maintained by people who do not follow security releases closely. Managed hosts and automatic updates will close much of the gap, and the sites that lag are the ones most likely to be probed once proof-of-concept code appears.

Two signals will show whether that matters. The first is whether the flaw appears in exploit attempts or on the US government's list of actively exploited vulnerabilities, which had not happened when the patch shipped. The second is whether a working exploit is published, since the fix makes the exact change visible and a public payload would shorten the time defenders have. Administrators on a supported branch should treat the update as done when it is applied, not when it is scheduled.

Cover: the WordPress administration dashboard, version 7.0. Screenshot by the WordPress Foundation, via Wikimedia Commons, GPL, cropped 16:9.