WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session
Read original article ↗AI Summary
A vulnerability in WordPress core, tracked as CVE-2026-93485 and dubbed 'Comment2Shell', allows an unauthenticated attacker to inject a malicious script via a crafted comment. When a logged-in administrator views the compromised page, the script executes in their browser context, enabling exploitation of admin privileges to upload a plugin containing a web shell, leading to remote code execution (RCE) on the server. The flaw exists due to improper handling of HTML during comment rendering, where a line break inside an attribute of an allowed tag can be manipulated to create an auto-executing event handler. The vulnerability affects WordPress versions from 4.7 to 7.1 and was patched in version 7.1.1 and other corresponding security releases.
AI-extracted · verify before operational use
No entities or IoCs were extracted from this article.