WordPress “Comment2Shell” XSS-to-RCE Chain Lets Unauthenticated Attackers Compromise Servers via Malicious Comments

A high-severity vulnerability, CVE-2026-93485 with a CVSS score of 7.1, affects WordPress Core versions 4.7 through 7.1.0. The flaw resides in the wpautop() function within wp-includes/formatting.php, which allows for remote code execution through a stored cross-site scripting vulnerability in the comment rendering pipeline. Attackers can inject specially crafted comments to exploit a mismatch between comment sanitization and HTML reformatting, leading to the injection of executable JavaScript. This vulnerability permits full server compromise if an administrator views the affected page, as the injected script can leverage the session to install a web shell plugin.

The existence of a high-severity vulnerability with low attack complexity, requiring no authentication for the initial entry point, points to a systemic failure in input handling across the WordPress ecosystem. The risk is amplified by the fact that exploitation requires only a passive action from an already authenticated administrator viewing the content, shifting the burden from active penetration to ambient system exposure. The recommended mitigation strategy—upgrading immediately alongside layered defensive measures like WAF deployment and comment disabling—reflects a necessary tension between immediate technical patching and organizational process changes. The implication is that even widely deployed systems are susceptible when internal data handling logic contains subtle, exploitable mismatches. When an attack path exists requiring only existing user permissions to execute code, the focus must shift from blocking external ingress to rigorously auditing internal execution pathways and default settings. What safeguards exist for automated patching in environments where manual intervention is deliberately avoided? How does the reliance on comment functionality become an acceptable risk in high-security deployments?