Comment2Shell: An Anonymous Comment Can Take Over an Entire Site

{"main_topic":"vulnerabilita","topics":["cybersecurity","cve","wordpress","rce","patch"]}

On September 17, 2026, WordPress released version 7.1.1 patching CVE-2026-93485, a stored XSS vulnerability in the CMS core that allows an unauthenticated visitor to inject malicious scripts via comments and, when viewed by a logged-in administrator, execute remote code on the server. The bug, dubbed Comment2Shell by the researcher who discovered it, exploits a differential parser mechanism between two legacy sanitization functions: wp_kses_post() and wpautop(). The severity is classified as High with a CVSS score of 7.1.

Key Takeaways

The XSS payload triggers due to a parsing discrepancy between storage and display: wp_kses_post() on the first pass does not recognize the construct as dangerous, while wpautop() on the second pass reformats it into an executable JavaScript event handler.
Escalation to RCE requires an authenticated administrator to open the comment page: the script hijacks the session to load a plugin containing a web shell.
Affected versions range from 4.7 to 7.1; the fix is available back to 4.7.36, but no evidence of active in-the-wild exploitation has emerged.

The Line Break Trick in the Differential Parser

The Comment2Shell attack chain nests in one of the oldest and least scrutinized pipelines in the WordPress core: comment processing. According to researcher Rafie Muhammad, affiliated with the Patchstack Bug Bounty program, the mechanism triggers with "a line break placed inside the attribute of an allowed HTML tag in the comment." The payload exploits an HTML tag permitted in the comment whitelist — the dossier cites area as an example — and places a strategic line break character inside an attribute.

The first sanitization phase, executed by wp_kses_post() at the moment of saving to the database, parses the markup and deems it clean because the line break prevents recognition of the dangerous pattern. The second phase, executed by wpautop() upon page display, inserts <p> tags and reformats the content. This reformatting shifts the line break, recompacting the attribute into a valid JavaScript event handler — for example onerror or onload — which the browser executes in the page context.

The result is a stored XSS: the payload persists in the database and triggers every time a user loads the comment page. The "stored" nature makes the attack more dangerous than a reflected XSS: it requires no direct social engineering or crafted URLs, only that the victim visit a legitimate page on the site.

From Comment to Shell: Admin Session Hijacking

JavaScript injection alone does not guarantee remote code execution on the server. Escalation occurs through hijacking the authenticated session of a WordPress administrator. When a user with elevated privileges — typically an administrator managing pending comments or simply viewing the thread — loads the page, the injected script operates with the permissions of their browser session.

With these privileges, the payload can make authenticated calls to the WordPress admin API to upload and activate an arbitrary plugin. The Hacker News explicitly reports that the script "could then use the administrator's own session to upload a plugin containing a web shell." This transforms a presentation flaw — the XSS — into full host compromise, with filesystem access and the ability to execute arbitrary PHP commands.

The vector works on both block themes introduced with the Gutenberg project and classic themes that format comments with wpautop(). The attack surface is therefore not restricted to a specific theme generation or a subset of installations.

Moderation as a False Security Boundary

A critical point in the dossier concerns WordPress.org's position on exploit conditions. The official vendor advisory describes the flaw as "subject to comment approval." However, WordPress's default configuration does not require comment moderation: any visitor can leave a comment without prior approval, save for the filter on a new user's first comment.

Patchstack has formally contested this framing: according to the source, "moderation isn't a security control." A first comment from an unverified user requires approval, but once this gate is passed — with a preliminary innocuous comment or other techniques — all subsequent comments are published automatically. The attacker can therefore build a history of seemingly legitimate interactions before injecting the final payload.

This dynamic makes the attack path practicable without prior human interaction from the administrator, beyond the final view that triggers the RCE. Moderation does not eliminate the risk; at most it delays it.

"The trick was a line break placed inside the attribute of an allowed HTML tag in the comment"

What to Do Now

The WordPress 7.1.1 release, published September 17, 2026, patches Comment2Shell along with 10 other security issues. The fix has been backported to version 4.7.36. The priority action for WordPress site administrators is immediate updating to 7.1.1 or the latest available backport for their branch.

For organizations with centralized management of WordPress site fleets: the vulnerability is in the core, not in a third-party plugin. No additional plugin-level security configuration eliminates the flaw; remediation requires patching the base code. Versions 4.7 through 7.1 are all affected.

Monitoring access logs for the admin interfaces /wp-admin/plugin-install.php and /wp-admin/update.php can reveal unauthorized plugin uploads performed via existing admin sessions, although the dossier does not document specific indicators of compromise for this vector.

Finally, restricting access to comment moderation and plugin panels to specific IP addresses, where operationally feasible, reduces the likelihood that an administrator views the malicious comment from a privileged session context.

A Recurring Pattern: Sanitization as Attack Surface

Comment2Shell is not an isolated incident in the WordPress vulnerability calendar. 2026 has already recorded a precedent of the same class: XSS2Shell (CVE-2026-64638, August), a reflected XSS in wp-login.php that exploited a differential between strip_tags() and wp_kses_post(). Comment2Shell moves the same principle into the comment domain, with the added complication of persistence.

Both bugs stem from the same structural root: the complexity of WordPress's sanitization pipeline, grown organically over nearly two decades of development, with legacy functions interacting in ways unforeseen by their individual authors. The question the dossier implicitly raises — and that security operators must now explicitly confront — is how many other parser differentials remain hidden in this code stratigraphy.

For a CMS powering over 43% of the web, core security is no longer a single-installation problem. It is a systemic risk.

Information has been verified against cited sources and updated at time of publication.

Sources

Sources and references

Get DeafLetter