WordPress Patches Comment2Shell, a Comment Flaw That Can Lead to Server Takeover
WordPress 7.1.1 fixed an unauthenticated stored cross-site scripting bug in wpautop(), tracked as CVE-2026-93485, that can escalate to remote code execution.
By TPW Editorial7 min read