Comment2Shell: Check WordPress Comments for CVE-2026-93485

Comment2Shell (CVE-2026-93485) lets an anonymous visitor plant a script in a WordPress comment that runs when the comment is displayed.^[1][3] If a logged-in administrator opens that page, the script can use their session to install a plugin and run code on the server.^[4] Update to WordPress 7.1.1 or later, then sweep your existing comments.

The patch shipped on September 17, and sites with automatic background updates should already have it.^[1] The researcher’s full write-up followed on September 21.^[4] The piece people skip is the second step: a patched site can still hold comments that were submitted before the update. Here’s the checklist we’d run on every site that takes public comments.

TL;DR: What to do right now

1. Confirm every site runs 7.1.1 or later, or the patched release for its branch (7.0.5, 6.9.8, and so on down to 4.7.36).^[2] If you already updated to 7.1.2 for CVE-2026-87902, you have this fix too.
2. Search the comments table, including pending and spam, for HTML with event-handler attributes. The query is below.
3. Until the sweep is done, don’t browse the front end of a site while logged in as an administrator.
4. Don’t treat moderation as the fix. Patchstack says plainly that “moderation isn’t a security control.”^[3]
5. If a suspicious comment was approved and an admin viewed that page, check for new plugins and admin users before you do anything else.

What CVE-2026-93485 (Comment2Shell) is

WordPress runs comment text through formatting functions before it shows it. WordPress.org lists the bug as an unauthenticated stored cross-site scripting (XSS) flaw in paragraph formatting, subject to comment approval.^[2] Patchstack traces it to wpautop(): the payload passes the comment sanitizer because it doesn’t look dangerous until it’s formatted for display.^[3]

Tenable lists CVE-2026-93485 with a CVSS v3 score of 7.1 and affected versions from 4.7 through 7.1.^[5] Rafie Muhammad reported it, and WordPress.org credits him in the 7.1.1 release notes.^[1]

How a comment becomes code execution

The XSS alone runs in the browser of whoever views the page. The researcher puts it simply: “The handler runs in the session of whoever loads the page.”^[4] For an anonymous reader, that’s bad but limited. For a logged-in administrator, the script can reach the plugin installer and upload a plugin containing a web shell.^[4][6] That’s where the name comes from.

The researcher’s write-up says it affects block themes and certain classic themes.^[4] We’d assume yours is affected and patch, rather than try to prove it isn’t.

Why moderation doesn’t save you

On a stock install, WordPress holds a first-time commenter’s comment for moderation, because the setting that requires a previously approved comment is on.^[3] Full moderation of every comment is off by default.^[4] Once someone has one approved comment, they’re auto-approved from then on.^[3] Patchstack also points out that the payload looks unremarkable in the moderation queue.^[3] Its advice to sites with public comments is to treat this as the priority fix in 7.1.1.^[3]

Step 1: Confirm every site is on a patched release

Patched versions by branch, from the WordPress.org release documentation:^[2]

Every branch in between got a fix too; the full list is in the release documentation.^[2] For a fleet, loop over your site folders with WP-CLI:

# Print the core version for each site path
for d in /var/www/*/; do
  printf '%s ' "$d"
  wp core version --path="$d" 2>/dev/null \
    || echo "not WordPress"
done

Adjust /var/www/*/ to wherever your installs live. Anything below the table’s minimum for its branch needs updating first.

Step 2: Sweep existing comments

Patching changes how comments are formatted from now on. It doesn’t delete anything already stored. This query lists comments that contain an event-handler attribute (onclick=, onmouseover= and so on) or a blockquote with a cite attribute, the element the researcher’s write-up centres on:^[4]

-- Replace wp_ with your table prefix
-- (run: wp db prefix)
SELECT comment_ID, comment_post_ID,
       comment_approved, comment_date
FROM wp_comments
WHERE comment_content REGEXP
      '[[:space:]]on[a-z]+[[:space:]]*='
   OR (comment_content LIKE '%<blockquote%'
       AND comment_content LIKE '%cite=%')
ORDER BY comment_date DESC;

Run it with wp db query or in phpMyAdmin. It searches every status: approved (1), pending (0), spam and trash. It will also flag some harmless comments from people pasting HTML, so read each hit before acting.

What to do with a hit

• Pending or spam: delete it permanently. Don’t open the post while logged in to check it.
• Approved, and no admin has viewed the page since: delete it, then check the next two items anyway.
• Approved, and an admin may have viewed it: treat the site as possibly compromised. Look for plugins and admin users you don’t recognise, and follow a full compromise cleanup checklist.

Can’t update today? Temporary stopgaps

The only real fix is a patched release. If one site has to wait a day, reduce exposure:

• Close comments on existing posts. The Discussion setting for new posts doesn’t touch old ones, so use WP-CLI:

# Stopgap only: close comments on all posts
wp post list --post_type=post,page \
  --format=ids \
  | xargs -r wp post update \
  --comment_status=closed

• Turn on Comment must be manually approved in Settings, Discussion, and don’t approve anything containing HTML until you’ve patched.
• Browse the site logged out or in a separate browser profile. The script runs with the permissions of whoever loads the page.^[4]
• If you use a web application firewall, check whether your vendor has a rule for CVE-2026-93485. The Hacker News lists firewall rules among the mitigations.^[6]

Where comment spam protection fits

Blocking junk comments before they’re stored keeps your moderation queue short, and a short queue is easier to review. It doesn’t fix a formatting bug in core. Only the update does that. We’d rather say that plainly than suggest otherwise.

If you want that first layer, the free Zero Spam for WordPress plugin screens comment, registration and form submissions, and our guide to stopping WordPress spam fast covers the setup. For IP reputation checks in your own code or across client sites, start on the free Explorer plan; code ZEROSPAM20 takes 20% off a paid license.^[8]

Is this being exploited?

As of The Hacker News report on September 22, there was no sign of Comment2Shell being used in attacks, and it wasn’t on CISA’s Known Exploited Vulnerabilities list.^[6] The researcher’s write-up is public, though, and it demonstrates the full chain to code execution.^[4] A week earlier, attackers probed CVE-2026-87902 within hours of its patch.^[7] We wouldn’t wait for this one to follow.

About Ben Marshall

Full-stack Developer & Engineering Manager

Ben Marshall is a full-stack developer and engineering manager who loves building solid software and helping teams do their best work. He’s equal parts builder and coach—focused on practical architecture, clean implementation, and making collaboration easier (and faster) for everyone.

• WordPress.org