Malicious code can be injected into WordPress websites through simple comments!
A digital vulnerability named CVE-2026-93485 has been identified in WordPress websites. By exploiting this vulnerability, an attacker can send a simple comment to the site and use it to execute malicious code in the administrator's browser later.
Researchers have named this attack method Comment2Shell. The most dangerous aspect is that the attacker might not need the administrator's password or a separate WordPress account to initiate the attack.
If the site administrator opens the malicious comment, the attacker might try to use the administrator's high privileges. In some cases, this can lead to the installation of malicious plugins or web shells on the WordPress site, resulting in commands being executed on the server.
WordPress fixed this issue in version 7.1.1. Therefore, it is recommended that WordPress website administrators check the system version and install security updates as soon as possible.
What is Comment2Shell?
Comment2Shell is an attack method that allows for the step-by-step development of an attack by using the comment function in WordPress.
Simply put, the attack can occur as follows:
Malicious comment → WordPress processes the comment → hidden JavaScript code is executed → the administrator opens the page → administrator privileges are used → a malicious plugin or file can be placed.
Thus, the starting point of the attack can simply be a comment on the site.
How does the vulnerability work?
WordPress checks comments submitted by users for security purposes and filters certain HTML elements.
However, in the case of CVE-2026-93485, a problem was identified related to the wpautop() function used during the process of displaying comments on the page.
The attacker sends a specially crafted comment. This comment uses the blockquote element and its cite attribute permitted by WordPress.
Initially, malicious data might pass through the security filters. Later, when WordPress processes this data to display it to the user, the HTML structure is unexpectedly changed.
As a result, the data can become attributes like onfocus or autofocus, which allow JavaScript code to be executed.
This way, the malicious code can run when the page loads, even without the user pressing any button.
Why is viewing the administrator's comment dangerous?
There is an important point here.
If a regular user sees the malicious comment, the attacker's opportunities might be limited. But if the WordPress administrator themselves sees the comment, the situation becomes much more serious.
This is because the administrator has much higher privileges in WordPress than a regular user.
After the malicious JavaScript runs in the administrator's browser, the attacker can try to perform actions using these privileges, such as:
- Accessing WordPress's administrative functions;
- Using plugin installation capabilities;
- Placing malicious files on the site;
- Creating web shells;
- Creating conditions for additional commands to be executed on the server.
Therefore, this vulnerability can escalate into a more serious attack chain than a simple "XSS via comment" issue.
Does the attacker need to know the administrator's password?
The administrator's password may not be required to initiate the attack.
The attacker first sends the specially crafted comment to the site. In the next step, the administrator needs to see this comment.
Thus, the attacker can try to execute malicious code in the administrator's browser without directly stealing the administrator's password.
However, this does not mean that any site is automatically compromised.
Several conditions must be met for the attack to be successful:
- The comment posting function on the site must be enabled;
- Anonymous users must be allowed to send comments or the malicious comment must reach the site through another means;
- The malicious comment must be visible on the page;
- The administrator must open this page in a certain state;
- The operating conditions of the site must support the attack chain.
Which WordPress versions are at risk?
The CVE-2026-93485 vulnerability is shown to affect versions of WordPress from 4.7 to 7.1.0.
WordPress fixed this vulnerability in version 7.1.1. Security patches have also been released for older versions that are still supported.
Therefore, it is not just about knowing the main WordPress version, but also checking if the relevant security updates are installed for the version being used.
Important:
Sites using WordPress versions 7.1.0 and earlier need to be updated.
If an organization uses an older WordPress network, they must check if the security updates released for that network have been installed.
Does the comment moderation function provide protection?
Publishing comments after administrator approval can reduce the risk of attack.
However, this is not a complete protection measure.
This is because the malicious content can still reach the administrator's browser during various processes, including when the administrator reviews comments or previews the page.
Therefore, the conclusion that "comments are approved by the administrator, so the site is safe" is not correct.
The most important protection measure is to update WordPress with security updates.
Why should block-theme users pay attention?
Through Comment2Shell, the attack chain exploits the page display processes related to some WordPress block themes.
Therefore, the attack does not necessarily work in the same way on all WordPress sites.
However, this should not be taken as a reason to consider sites using classic themes as safe. Because the main problem is related to WordPress's internal wpautop() function.
Therefore, all WordPress administrators must install security updates.
How should organizations check their sites?
Technical experts of organizations using WordPress should not be limited to just updating the system but should also check for the presence or absence of attack traces on the site.
1. Check the WordPress version
First, determine the WordPress Core version of the site.
If an old version is being used, install the relevant security update as soon as possible.
2. Check for suspicious comments
Analyze new and modified comments in the wp_comments database.
Pay special attention to the following:
blockquote;cite;onfocus;autofocus;
- Unusual HTML code;
- Unintelligible symbols and line breaks;
- Data resembling code sent by the user.
These symbols do not automatically mean the site is broken. But they can be a signal for further investigation.
3. Check server logs
It is recommended to analyze suspicious requests sent to the following addresses:
wp-comments-post.php;wp-admin/update.php;
- Requests related to plugin installation;
- Logins to administrator accounts;
- File upload activities.
Especially if it is found that a plugin or file has been installed from an administrator account after a suspicious comment was sent, the incident should be investigated further.
Pay attention to unknown plugins and PHP files
If the Comment2Shell attack chain is successfully completed, the attacker might try to place malicious plugins or PHP web-shells on the site.
Therefore:
Checking the wp-content/plugins directory is important.
The following situations should raise suspicion:
- Plugins not installed by the administrator;
- Unknown PHP files that have recently appeared;
- Unusual files in the plugin directory;
- Files with changed or hidden names;
- Unexpected ZIP archives;
- Recently modified PHP files.
These files should be kept for incident investigation before simply deleting them.
If it is suspected that the site is compromised
If suspicious comments, unknown plugins, or malicious PHP files are found, the incident should not be considered concluded by simply deleting the file.
The following measures are recommended:
- Identifying suspicious files and comments;
- Keeping server and WordPress logs;
- Checking the activity of administrator accounts;
- Identifying unknown plugins;
- Checking the wp-content/plugins directory;
- Analyzing newly created PHP files;
- Changing administrator passwords;
- Deleting active administrator sessions;
- Updating WordPress, plugins, and themes;
- Checking for the presence of web shells or other hidden access mechanisms.
If it is confirmed that malicious code has been placed on the site, a full investigation and identifying any other access opportunities left by the attacker are necessary.
What to do if updating is not possible?
If there is no technical possibility to update WordPress immediately, temporary protective measures can be taken.
For example:
- Temporarily disable the comment posting function;
- Block anonymous comments;
- Subject comments to strict moderation;
- Monitor administrator accounts;
- Monitor suspicious requests in WAF and other protection tools;
- Regularly analyze server logs.
However, none of these can replace a security update.
Why should this vulnerability be taken seriously?
The danger of Comment2Shell starts from the simple appearance of the attack.
A user sends a simple comment to the site. The administrator might see it as a regular comment.
But when the comment is processed by WordPress, it can be used to execute malicious JavaScript code.
Then the attack can attempt to use the administrator's high privileges and in some cases, place malicious code on the server.
That is:
Simple comment → hidden malicious code → administrator browser → WordPress administrative privileges → malicious plugin → risk to the server.
This is why it is important to monitor the comment function on WordPress websites from a cybersecurity perspective.
CVE-2026-93485 is a serious security vulnerability related to the comment processing process on WordPress websites.
Exploiting the vulnerability, the attacker can try to execute malicious JavaScript code in the administrator's browser using a specially crafted comment. If the administrator has accessed the system with high privileges, the attack chain can extend to using WordPress's administrative functions and, in some cases, placing malicious files or web shells on the server.
Therefore, WordPress website administrators and technical experts must:
Update WordPress, check comments, analyze server logs, identify unknown plugins and PHP files, and monitor administrator accounts.
This is important to prevent attacks that can lead to the takeover of the site.
Attackers can try to gain access through a simple comment on the site. Therefore, the view that "this is just a comment" may be incorrect from a security perspective.
Attention to information and cybersecurity managers and technical experts! Installing security updates in a timely manner, monitoring comment activity, and regularly checking for suspicious files are crucial in preventing attacks that can lead to the takeover of the site.