Vulnerabilities · 3h ago

WordPress Comment Bug Could Escalate to Server Control

WordPress fixed a core comment flaw, CVE-2026-93485, in version 7.1.1 on September 17 after Rafie Muhammad found that an anonymous comment could plant a hidden script that becomes dangerous when a logged-in administrator views the page. Patchstack assigned the identifier and rated it 7.1/10.

The bug sits between save-time filtering and render-time rewriting. WordPress checked the comment when it was stored, then reshaped the same HTML when it was displayed; a line break inside an allowed tag survived the first pass but turned into a live browser handler on the second, so the page ran attacker code automatically. If an admin’s session is present, that browser-side code can use it to push a plugin and reach server code execution.

For sites that allow public comments, the exposure lives in content that looks harmless at entry time but changes shape when rendered. Moderation is not a clean boundary here: the risky step is the display path, and any CMS that rewrites stored user content on output inherits the same trust problem.

CVE-2026-93485

NVD KEV

CVSS 7.1 HIGH: improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Automattic… EPSS 0.2% (6th percentile).

Timeline

Sources

1 source covering this story

Entities

Part of the PlainSec briefing for 2026-09-22

Editions

Related stories