Critical WordPress Comment2Shell RCE Vulnerability CVE-2022-0215 Patched

Key Takeaways

• A critical vulnerability, CVE-2026-93485, in WordPress allows unauthenticated attackers to achieve server-side remote code execution.
• The flaw, dubbed “Comment2Shell,” exploits a stored cross-site scripting (XSS) issue within the wpautop() formatting function.
• WordPress versions from 4.7 up to 7.1.0 are affected, with a patch available in version 7.1.1 and various branch-specific updates.
• Exploitation requires an administrator to view a maliciously crafted comment, which can then lead to a webshell upload.

WordPress Comment2Shell Vulnerability Unveiled: RCE from a Comment

WordPress administrators are urged to immediately apply patches for a high-severity vulnerability, identified as CVE-2026-93485. This critical flaw, colloquially known as Comment2Shell, enables an unauthenticated attacker to achieve remote code execution (RCE) on a server simply by submitting a specially crafted comment.

The Mechanics of Comment2Shell

The vulnerability stems from a stored cross-site scripting (XSS) flaw within WordPress’s wpautop() formatting function. While initial sanitization (KSES) prevents direct script injection, the issue lies in how WordPress processes specific HTML markup within comments. An attacker can embed a malformed newline character inside the cite attribute of an allowed blockquote element. This seemingly innocuous input bypasses initial security checks.

When the comment is subsequently rendered, the wpautop() function attempts to reformat the content. During this process, the crafted newline is replaced with an HTML-comment placeholder. Crucially, a faulty regular expression within the formatting logic prematurely terminates at the first closing angle bracket, inadvertently injecting a paragraph element directly inside the attribute. This manipulation leads to the browser interpreting attacker-controlled onfocus and autofocus attributes, which automatically trigger JavaScript execution when the page loads.

Escalation to Remote Code Execution

The resulting XSS payload executes with the privileges of the user viewing the post. If a logged-in administrator views the compromised comment, the attacker’s JavaScript gains access to WordPress administrative functions. This allows the payload to retrieve the plugin-installation nonce, construct a malicious ZIP archive in the browser, and then upload it as a plugin, effectively installing a webshell on the server. Syed Wajeeh-ul-Hassan Rizvi’s proof-of-concept published demonstrates this full attack chain, which concludes with the execution of arbitrary commands and the removal of the PHP shell and plugin directory to minimize detection.

The attack does not require any pre-existing attacker account or a pre-obtained nonce. However, successful exploitation hinges on several conditions: comments must be enabled, anonymous submissions must be accepted, and the malicious comment must become visible. The demonstrated exploit chain specifically targets rendering behavior in block themes; classic themes may not exhibit the same attribute transformation that facilitates the exploit. While comment approval can delay immediate exposure, it should not be considered a robust security measure, as previously approved identities or preview functionalities could still render the crafted content.

Scope and Mitigation

CVE-2026-93485 carries a CVSS 3.1 score of 7.1, indicating a high-severity vulnerability. It impacts WordPress versions from 4.7 through 7.1.0, with patched builds extending back to version 4.7.36. Rafie Muhammad of Awesome Motive initially reported the underlying wpautop() vulnerability through WordPress’s coordinated disclosure program. The Comment2Shell project then independently packaged this issue into a comprehensive, dependency-free Python toolkit that includes a scanner, laboratory environment, exploit demonstration, Nuclei template, and indicator of compromise (IOC) checker.

Although researchers had not reported active exploitation at the time of disclosure, the public availability of the proof-of-concept significantly lowers the barrier for potential attackers. Organizations should therefore prioritize patching and remain vigilant for any unexplained comment activity or unusual plugin directory modifications, which could signal a compromise.

What You Should Do

• Update Immediately: Upgrade your WordPress installation to version 7.1.1 or the latest patched release available for your specific maintained branch.
• Inspect Database: Review the wp_comments database for any unusual combinations involving blockquote, cite, onfocus, or autofocus attributes.
• Monitor Network Traffic: Scrutinize requests to wp-comments-post.php and wp-admin/update.php for suspicious activity.
• Check File System: Hunt for recently created, unfamiliar PHP files within the wp-content/plugins directory.
• Disable Comments (Temporary Mitigation): If immediate patching is not feasible, consider temporarily disabling comments to reduce exposure.
• Incident Response: In the event of a suspicious plugin upload, initiate a full incident response review, examining administrator sessions, server files, logs, credentials, and persistence mechanisms.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.