Vulnerabilities & Exploits

WordPress patch closes a second route to server execution

On September 21, researcher Rafie Muhammad detailed Comment2Shell (CVE-2026-93485), a second WordPress core route from attacker-controlled content to server code, alongside the previously reported Click2Shell. WordPress fixed both in version 7.1.1 on September 17; neither report describes confirmed exploitation.

Comment2Shell exploits a gap between WordPress checking a comment when it is saved and reformatting it for display: a line break can turn text in an allowed HTML tag into a script that runs when the page loads. For server access, the comment must appear on the page and an administrator must view it; the script can then use that administrator’s session to upload a plugin containing a web shell. Click2Shell follows a different path: a logged-in user’s visit can trigger theme installation and preview.

For sites using block themes or affected classic comment formatting, the two flaws put different authenticated browser actions in play. A core version check alone cannot establish whether a comment was displayed and viewed during the vulnerable period.

3 sources · Sep 22

CVE-2026-93485

NVD KEV

CVSS 7.1 HIGH: improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Automattic… EPSS 0.8% (56th percentile).

Timeline

Sep 22 Reported by SecurityWeek
Sep 21 Reported by BleepingComputer

Sources

Sep 22 SecurityWeek
WordPress Patches ‘Click2Shell’ Vulnerability
The bug lets attackers automatically install and preview themes and could lead to remote code execution.
original
Sep 22 The Hacker News
WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session
WordPress fixed a comment flaw that could lead to server code execution if a logged-in administrator opened the page.
original
Sep 21 BleepingComputer
WordPress Click2Shell flaw lets hackers execute PHP on the server
Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed 'Click2Shell' that affects the platform's Core component.
original

Part of the PlainSec briefing for 2026-09-19

Every edition of this story: WordPress patch closes a second route to server execution

More from today

Vulnerabilities & ExploitsWordPress patch closes a second route to server executionOn September 21, researcher Rafie Muhammad detailed Comment2Shell (CVE-2026-93485), a second WordPress core route from attacker-controlled content to server code, alongside the previously reported Click2Shell. WordPress fixed both in version 7.1.1 on September 17; neither report describes confirmed exploitation.Comment2Shell exploits a gap between WordPress checking a comment when it is saved and reformatting it for display: a line break can turn text in an allowed HTML tag into a script that runs when the page loads. For server access, the comment must appear on the page and an administrator must view it; the script can then use that administrator’s session to upload a plugin containing a web shell. Click2Shell follows a different path: a logged-in user’s visit can trigger theme installation and preview.For sites using block themes or affected classic comment formatting, the two flaws put different authenticated browser actions in play. A core version check alone cannot establish whether a comment was displayed and viewed during the vulnerable period.3 sources · Sep 22

CVE-2026-93485

NVD KEV

CVSS 7.1 HIGH: improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Automattic… EPSS 0.8% (56th percentile).

Timeline

Sep 22 Reported by SecurityWeek

Sep 21 Reported by BleepingComputer

Sources

Sep 22 SecurityWeek

WordPress Patches ‘Click2Shell’ Vulnerability

The bug lets attackers automatically install and preview themes and could lead to remote code execution.

original

Sep 22 The Hacker News

WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session

WordPress fixed a comment flaw that could lead to server code execution if a logged-in administrator opened the page.

original

Sep 21 BleepingComputer

WordPress Click2Shell flaw lets hackers execute PHP on the server

Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed 'Click2Shell' that affects the platform's Core component.

original

Part of the PlainSec briefing for 2026-09-19Every edition of this story: WordPress patch closes a second route to server executionMore from today

Orkes Conductor bug turns workflows into shell access

Redis TLS bug is already being exploited

Microsoft cloud flaws were fixed server-side