WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session

WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session Swati KhandelwalSep 22, 2026Vulnerability / Web Security A new flaw in WordPress core let an anonymous visitor leave a comment that planted a hidden script on the page. If a logged-in administrator later opened that page, the script could run code on the site's server. WordPress fixed the flaw, tracked as CVE-2026-93485 and dubbed "Comment2Shell," on September 17 in version 7.1.1 and told site owners to update right away. There is no sign it has been used in attacks, and it is not on the U.S. government's list of actively exploited software flaws. Patchstack, the company that assigned that identifier, rated the flaw 7.1 out of 10…