WordPress fixes Comment2Shell (CVE-2026-93485) with patch 7.1.1 for the core 4.7-7.1

On September 17 WordPress published a patch that fixes a vulnerability in the core - registered as CVE-2026-93485 and baptized by the community as "Commentary 2Shell" - which allowed an anonymous visitor to publish a comment containing a hidden script. If an authenticated administrator then opened the page with that comment, the code could take advantage of the administrator's session to run actions with privileges over the server, including raising a malicious plugin that acts as a web shell. WordPress solved the problem in version 7.1.1 and alerted site managers to update immediately. The official WordPress security note and the CVE tab in the public catalogue contains the basic details.

The confirmed facts are as follows: the failure affects versions of the core from 4.7 to 7.1; WordPress released specific corrections for each branch (e.g. 7.1 → 7.1.1, 7.0 → 7.0.5, 6.9 → 6.9.8 and other branches up to 4.7.36); the vulnerability was reported by the researcher Rafie Muhammad and publicly described in a technical publication; Patchstack assigned and documented the entry and gave him a score of 7.1 / 10 on the CVSS scale; and, according to public statements to date, there is no known evidence of exploitation in mass attacks or in government active exploitation lists. Patchstack keeps a tab with analysis and classification.

Technically, the vulnerability arises from a discoordination between two different steps in the treatment of comments: WordPress valida and filtra HTML "dangerous" when the comment is saved, and then applies an additional (sanitized / escaped) reformated when the comment is shown on the page. The attack vector took advantage of a gap between these processes: by deliberately introducing a line jump into the attribute of an HTML label allowed in the comment, the rendering phase fragments the label and moves the attacker's text to a position that the browser interprets as an event manager (e.g. an onload or similar). This handler is automatically run by loading the page, without user interaction. The execution of the script occurs in the context of the browser of who uploads the page and inherits the level of access of that session.

To scale from running in the browser to running code on the server, two additional conditions are needed, both confirmed by the research: first, the victim who opens the page must be an authenticated administrator; second, the script must perform actions that use the administrator session to upload a malicious plugin (or activate equivalent code import routes). The technique of uploading a plugin containing a web shell is a well-known way to turn an administrator session into persistent server control.

Important: vulnerability does not affect all sites equally. It works only on sites whose theme (or comment scheme) formates comments in the vulnerable form: it occurs in block and in some classic themes that replicate the same reformed. In addition, although WordPress described the failure as "exploitable subject to comment approval," default moderation and first-time rules to comment do not constitute infallible control: the configuration can leave comments without moderation, and in many scenarios the moderation barrier can be drawn or not activated. Patchstack summarized this with the observation that "moderation is not a security control."

On the real risk: it is confirmed that vulnerability allows, under specific conditions, an escalation to execution on server if an administrator visits the affected page. What remains uncertain or a reasonable estimate is whether malicious actors have already taken advantage of Comment2Shell in real campaigns - so far there is no public evidence of exploitation - and what number of facilities in production meet all the necessary conditions (vulnerable theme, attainable public comments, administrators visiting the page). Even in the absence of evidence of mass exploitation, the combination of ease of publication of comments and of administrators who visit public pages makes the defect operational and worthy of immediate attention.

What should a WordPress site manager do now: the first and mandatory is to update the kernel to the corrected version for its branch. The versions to be installed are at least 7.1 → 7.1.1; 7.0 → 7.0.5; 6.9 → 6.9.8; and, if you use previous branches up to 4.7, install the parched version available for that branch (the corrections were published for the supported branches). The update closes vulnerability, but no changes that an attacker had already made.

If you cannot apply the update immediately, mitigate the vector by blocking the publication of new public comments: close the comments in old entries, or disable the comments globally until you update. A web application firewall (WAF) or security plugins (e.g., trade rules in Cloudflare, Sucuri or mod _ security rules) can intercept and block the load of the malicious comment, although effectiveness depends on the signatures and rules available. Do not rely solely on the moderation of comments as a defence.

If you suspect that your site may have been compromised before the patch, do the following specific checks: look for new or modified plugins or files in wp-content / plugins and wp-content / uploads; review active plugin lists and compare with previous inventories; use tools such as' wp core verify-checksums' (WP-CLI) to detect altered core files; scan the site with reputation and malware engines (Wordfence, Sucuri, VirusTotal for suspicious files); check cron jobs in the usual user's log and log-in, and log-in / log-out of the user's inversions; and change all unusual user's access. Any cleaning work should be done on a copy or in maintenance, and it is recommended to restore from a clean backup if compromise is detected.

As additional preventive measures that should be applied after correction: limit the ability to install plugins / themes to a few trust accounts, enable multifactor authentication for administrative accounts, restrict access to / wp-admin by IP or by additional HTTP authentication if possible, and keep the extensions and themes up to date. Evaluate the adoption of a managed WAF and file integrity alerts to detect early handling.

Public sources and technical documentation on the patch and classification are available in the WordPress note and in the Patchstack tab; the public CVE entry offers the official designation of vulnerability. Check those ads and schedule the update as soon as possible: the patches are available and apply the correction is the action that removes the exposure window. Sheet CVE (Mitre) and Patchstack - CVE-2026-93485 contain more technical details and references.