The bug: a gap between saving a comment and showing it
WordPress core has patched a vulnerability, tracked under the Common Vulnerabilities and Exposures (CVE) system as CVE-2026-93485 and nicknamed "Comment2Shell" by the researchers who found it, that let an ordinary, unauthenticated blog comment end in full control of the server it was posted to. It carries a CVSS (Common Vulnerability Scoring System) severity rating of 7.1 out of 10, and it affects every WordPress core release from version 4.7 up through 7.1, which is to say nearly every WordPress site still receiving updates and plenty that are not.
The root cause sits in a WordPress core function called wpautop(), which formats comment text for display. WordPress checks and cleans up comment content when it is first saved, but the display-time formatting step in wpautop() handles certain HTML tags differently than the save-time check expected. A comment containing a line break placed inside the attribute of an allowed HTML tag exploits that mismatch: when wpautop() reformats the comment for display, the tag structure breaks apart in a way that relocates part of the attacker's text into a position where the browser reads it as a live, auto-running event handler, no click or user action required.
From a stored script to a server shell
On its own, that is a stored cross-site scripting (XSS) bug, meaning malicious script gets permanently saved and later runs in other people's browsers. What makes this one dangerous is who ends up viewing it. Comments typically show up in a site's administration dashboard for moderation, so the person most likely to load the page containing the poisoned comment is a logged-in site administrator. When that happens, the injected script runs with the administrator's active session and permissions, and can be used to install a plugin that functions as a web shell, a foothold that gives the attacker ongoing remote code execution on the server. An attack that starts as an anonymous comment on a public blog post can end with the attacker able to run arbitrary commands on the machine hosting the site.
Who found it, and what is fixed
Security researcher Rafie Muhammad reported the flaw through the WordPress bug bounty program Patchstack. WordPress shipped the fix on September 17, 2026, in version 7.1.1, alongside backported patches for every actively maintained older branch, down to 7.0.5, 6.9.8, and all the way to 4.7.36 for the oldest supported line. The 7.1.1 release bundled ten other, unrelated security fixes at the same time, so upgrading is worth doing regardless of whether Comment2Shell alone would have worried you.
As of the patch's release, there is no evidence of the flaw being used in real attacks, and it does not appear on the United States Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities list. That is the good news. The less comfortable part is that full technical detail on how the bug works, along with working proof-of-concept exploit code, is already public, which typically shortens the window before opportunistic scanning begins.
What to do about it
Updating is the straightforward fix, and most WordPress installations will offer it as a one-click core update from the dashboard or apply it automatically if automatic background updates are enabled, which they are by default for minor releases like 7.1.1. If you manage a site and cannot update immediately, either turn off comments site-wide until you can, or configure a web application firewall to filter out comment submissions containing the malformed HTML attribute pattern the exploit relies on. If you run or manage a site that has attracted hostile attention before, such as one tied to a business, newsroom, or public figure, it is worth checking your plugin list and file system for anything unrecognized, in case the flaw was already used against you before the patch existed.
What this means for the wider web
WordPress powers a large share of all websites, so a core vulnerability like this one is never just one site's problem. The practical lesson for anyone running a WordPress site is that comment sections are a standing attack surface even when comments require no login to post, and that the account most worth protecting on any WordPress install is the administrator's, since it is the one an attacker is trying to borrow. Keeping core, themes, and plugins updated promptly remains the single highest-leverage defense against exactly this kind of bug.
