Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

WordPress core comment-to-RCE flaw (CVE-2026-93485)

Vulnerability
First reported
Last updated
Happening score
H score 48
1 unique sources, 1 articles

Summary

Hide ▲

WordPress core had a comment-processing flaw in CVE-2026-93485 that could let an anonymous comment plant a hidden script and, if a logged-in administrator opened the page, reach server-side code execution. WordPress 7.1.1 fixed the bug on September 17, and the affected range spans 4.7 through 7.1. The issue is rated 7.1/10 CVSS by Patchstack and is not known to be actively exploited.

Related Happenings

WordPress core Click2Shell security flaw

Vulnerability
H score37 First: 18.09.2026 19:56 Last: 18.09.2026 19:56 Sources 1

How related: The same release fixed a second flaw, called Click2Shell, in which a crafted link could make WordPress install a theme and, together with a second weakness in that theme, run code on the server.

About this happening: WordPress core’s Click2Shell vulnerability is a CSRF chain that can let a logged-in administrator open a crafted URL, force-install a theme from the WordPres...

Latest development: 21.09.2026 21:23

pwn.ai publishes technical details and a complete proof-of-concept for Click2Shell, a WordPress Core CSRF chain that can let a logged-in administrator open a crafted URL, force-install a theme from the WordPress.org catalog, and execute arbitrary PHP on the server. The write-up says the flaw affects WordPress Core 7.1.0 and earlier, and that the underlying issue can be leveraged to force-install other vulnerable themes as well.

Open Happening

Timeline

  1. 22.09.2026 09:03 2 articles · 1h ago

    WordPress releases 7.1.1 for CVE-2026-93485

    Mitigation Patch Update

    WordPress fixed CVE-2026-93485, also called Comment2Shell, in version 7.1.1 and urged site owners to update immediately. The flaw sat between comment storage and page rendering, letting a hidden script survive until a logged-in administrator opened the page and could use that session to reach server-side code execution.

    Show sources
    Open in new tab
  2. 21.09.2026 03:00 1 articles · 1d ago

    Rafie Muhammad details the WordPress Comment2Shell exploit chain

    Technical Analysis Update

    Rafie Muhammad laid out how a line break inside an allowed HTML tag could become a live event handler when WordPress reformatted the comment for display, causing the script to execute automatically as the page loaded. The chain required a logged-in administrator to open the page before the administrator session could be used to upload a plugin carrying a web shell, and WordPress described exploitation as subject to comment approval.

    Show sources
    Open in new tab