WordPress Comment2Shell CVE-2026-93485: anonymous comment stored XSS in wpautop() → admin session RCE chain (fixed 7.1.1)

WordPress 7.1.1 (17 September 2026) fixes an unauthenticated stored XSS in core wpautop() that Patchstack tracks as CVE-2026-93485 (CVSS 3.1 7.1 High, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and industry coverage dubs Comment2Shell. An anonymous visitor submits a comment with a line break inside an allowed HTML attribute; comment sanitisation (wp_kses) accepts it, then display-time reformatting turns the payload into a live event handler. When a logged-in administrator later opens the page, the script runs in their browser session and can upload a malicious plugin (web shell) — server RCE requires that admin session and a theme that renders comments in the vulnerable path (block themes / compatible classic themes). WordPress wording: exploitable “subject to comment approval”; Patchstack notes moderation is not a security control (default first-comment hold can be bypassed). No in-the-wild exploitation claimed; not on CISA KEV. Affected: WordPress 4.7 through 7.1 before the 17 Sep security builds. Fixed: 7.1.1, 7.0.5, 6.9.8, and matching backports through 4.7.36. Distinct from desk card wordpress-click2shell-20260918 (theme-preview forced install in the same 7.1.1 release). Primary: WordPress 7.1.1 release; Patchstack analysis; wire: The Hacker News 22 Sep 2026.

Product

WordPress core (wpautop() comment display / formatting)

Versions

Affected: WordPress 4.7 through 7.1 before the 17 Sep 2026 security builds. Fixed examples: 7.1.1, 7.0.5, 6.9.8, and backports through 4.7.36 per WordPress/Patchstack.

CVSS

7.1 (CVSS 3.1 High; Patchstack)

Exploited in Australia?

unknown

Patch to

Upgrade to WordPress 7.1.1 (or the matching security backport for your branch, e.g. 7.0.5 / 6.9.8 / … / 4.7.36); automatic updates will pull it where enabled; review unmoderated comments and restrict plugin uploads to trusted admins until patched

Primary: WordPress — 7.1.1 maintenance and security release (17 Sep 2026; wpautop stored XSS) · Vendor: WordPress.org News — 7.1.1 · CVE: CVE-2026-93485 · Patchstack — WordPress 7.1.1 / CVE-2026-93485 wpautop() (18 Sep 2026); also THN Comment2Shell 22 Sep

vulnerabilities cloud