A newly disclosed WordPress core vulnerability lets anyone who can leave a comment plant code that runs with an administrator's own privileges — no login, no plugin, no click required. WordPress has patched it, but the flaw is already on the US government's list of actively exploited vulnerabilities.
What happened
Tracked as CVE-2026-93485 and nicknamed "Comment2Shell," the bug sits in how WordPress core handles comment display, not comment submission. Content is sanitized correctly when a comment is saved — the problem shows up later, when the page reformats the comment for display. That reformatting step can split a tag apart and relocate an attacker's text into a spot the browser reads as a live event handler, one that fires automatically the moment the page loads, no click needed.
That script runs in the browser of anyone who views the page, logged in or not. But it only reaches the server if a logged-in administrator is the one who opens it. When that happens, the script rides the administrator's own session to upload a plugin file that acts as a web shell — a well-known path from "admin views a page" to full server control.
The flaw carries the maximum CVSS score of 10.0 and affects sites running a block theme, the WordPress default since version 5.9, along with some classic themes that format comments the same way. WordPress has described it as exploitable "subject to comment approval": a first-time commenter's post is normally held for moderation and doesn't render on its own. Researchers who reported the bug found ways around that check, underscoring that comment moderation was never designed as a security control.
Why it matters
This is the rare WordPress core flaw that needs zero authentication from the attacker and zero interaction from the victim beyond opening a normal admin page. Any WordPress site accepting public comments on a block-based or affected classic theme is a candidate, and the combination of maximum severity, no login requirement, and confirmed in-the-wild exploitation is exactly the profile that lands on watchlists fast.
The same release also closed a related flaw nicknamed "Click2Shell," where a crafted link could trigger a theme install and chain into server-side code execution — again gated behind an administrator opening the link. Both sit alongside a string of serious WordPress core issues disclosed this year, including an unauthenticated code-execution bug in July that US authorities confirmed was used in real attacks, and a login-page scripting flaw found in August that also required an administrator account to complete the chain.
What to do
- Update immediately to WordPress 7.1.1, or to the latest patched release on your branch:
- 7.1.x → 7.1.1
- 7.0.x → 7.0.5
- 6.9.x → 6.9.8
- Older branches have fixes going back to 4.7.36 — check the release notes for your specific version.
- If you can't patch right away, close comments and comment submissions site-wide, or have your WAF block malformed comment payloads as a stopgap.
- Patching doesn't undo an existing compromise. If your site was reachable before you updated, check installed plugins and files for anything you don't recognize — the update closes the door but doesn't remove a backdoor that's already inside.
- Review admin hygiene: limit who holds administrator accounts, and treat "an admin opened a page" as a real attack surface, not a safe default.