WordPress users are being cautioned to address a significant vulnerability that could allow attackers to execute commands via site comments. This high-severity flaw, identified as CVE-2026-93485, is linked to the wpautop() function of WordPress, leading to potential command execution from anonymous comments. The vulnerability has been resolved in WordPress version 7.1.1, and site administrators are advised to update without delay.
Understanding the Vulnerability
The issue, showcased in the Comment2Shell proof-of-concept, involves a stored cross-site scripting (XSS) vulnerability. This flaw is exploited when a specially crafted comment, appearing harmless, is processed by WordPress. Specifically, a newline embedded within the cite attribute of a blockquote element can bypass initial KSES sanitization and later be transformed into executable JavaScript when rendered.
During rendering, the wpautop() function replaces the newline with an HTML-comment placeholder. A flawed regular expression then misinterprets the closing angle bracket, inserting unintended elements that execute attacker-controlled scripts. If a logged-in administrator views such a comment, it could lead to unauthorized administrative actions, exploiting plugin installations and more.
Proof-of-Concept and Mitigation
The Comment2Shell demonstration by Syed Wajeeh-ul-Hassan Rizvi reveals how an attacker can execute commands, clean up traces, and leave minimal evidence of the breach. The attack requires comments to be enabled and visible, with a logged-in admin viewing the crafted content. Notably, the vulnerability does not require any pre-obtained credentials or accounts.
While blocking comments may reduce exposure, administrators are urged to update to WordPress 7.1.1 or the latest patched version. Regular checks of the wp_comments database for unusual patterns and monitoring suspicious admin activities are recommended. Disabling comments temporarily can also serve as a preventative measure until a patch is applied.
Preventive Actions and Recommendations
WordPress releases affected by this vulnerability range from 4.7 to 7.1.0. The flaw was reported by Rafie Muhammad through WordPress’s secure disclosure process. The Comment2Shell project provides tools for scanning and exploiting this vulnerability, highlighting the need for immediate defensive measures.
Administrators should ensure updates are applied promptly and review any unusual activity in plugin directories. Monitoring wp-comments-post.php and wp-admin/update.php for irregular requests is crucial. Until the issue is fully addressed, vigilance in examining plugin uploads and administrator sessions is advised.
While there have been no reported active exploitations, the availability of the proof-of-concept increases the risk of replication. Organizations must prioritize securing their sites and treating any unexplained comment or plugin activity as potential compromises.
