From Comment to Shell: Dissecting CVE-2026-93485 in WordPress Core and the Perils of Parser Discrepancies
Date: September 22, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Web Application Security / Vulnerability Analysis / Exploit Walkthrough
Tags: WordPress, CVE-2026-93485, Comment2Shell, XSS to RCE, wp_kses, wpautop, AppSec
Executive Summary
On September 21–22, 2026, security researcher Rafie Muhammad and vulnerability intelligence firm Patchstack published full technical details on CVE-2026-93485—dubbed "Comment2Shell"—a critical stored cross-site scripting (XSS) vulnerability residing in WordPress Core. Officially patched on September 17 in WordPress version 7.1.1, the flaw allows an unauthenticated, anonymous visitor to escalate a standard blog comment into full Remote Code Execution (RCE) on the underlying web server.
While assigned a moderate CVSS v3.1 score of 7.1 due to its reliance on administrative interaction, the real-world operational severity is severe: any site with open comments (the default configuration for WordPress across millions of blogs, corporate sites, and e-commerce stores) is exposed. The vulnerability exploits a subtle structural divergence between WordPress's input sanitization engine (wp_kses) and its content-formatting rendering engine (wpautop).
When an administrator reviews the pending comment moderation queue in /wp-admin/edit-comments.php, the malformed HTML attribute reassembles in the DOM, executing arbitrary JavaScript within the administrator's authenticated session. The script then transparently leverages WordPress core’s REST API and administrative nonces to write a persistent PHP web shell into the active theme, resulting in complete server takeover without requiring any brute-force attempts or stolen credentials.
Technical Deep-Dive: The Parser Discrepancy Flaw
The root cause of CVE-2026-93485 lies in the architectural separation between how WordPress validates incoming HTML during submission and how it formats HTML prior to display.+-----------------------------------------------------------------------------------+
| CVE-2026-93485 "COMMENT2SHELL" CHAIN |
|---|
Anonymous Attacker WordPress Ingestion Admin Dashboard
| | |
| 1. POST /wp-comments-post.php | |
| [Crafted HTML with Newlines] | |
|------------------------------------>| |
| | 2. Input Sanitization |
| | wp_kses() treats attribute |
| | as benign / split |
| | 3. Stored in `wp_comments` db |
| | |
| | | 4. Admin logs into /wp-admin
| | | Navigates to Comments Queue
| | |------------------------------>
| | 5. Output Rendering |
| | wpautop() inserts paragraphs, |
| | mutates tag whitespace |
| | 6. Rendered HTML delivered |
| |---------------------------------->|
| | |
| | | [BROWSER DOM PARSER]
| | | - Reconstructs executable XSS
| | | - Fires `onload` / `autofocus`
| | |
| | 7. AJAX POST to Theme Editor |
| | with Admin's active _wpnonce |
| |<----------------------------------|
| | |
| | 8. Appends PHP Web Shell to |
| | `/wp-content/themes/*/index.php`|
| | |
| 9. Attacker accesses web shell | |
| `GET /wp-content/themes/...` | |
|------------------------------------>| |
v [FULL ROOT / SERVER TAKEOVER] v v
1. The Gatekeeper: wp_kses()
WordPress uses KSES (wp_kses), a customized HTML sanitization library, to scrub untrusted user inputs. For unauthenticated comments, KSES strips dangerous HTML tags (