CVE-2026-93485Patch

HIGHCVSS 7.1 · HIGH

Exploitation observed; activity peaked at 22 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.

Back to dashboard

7.8/ 10 priority

Sources & remediation

Other references

https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve

Weakness type (CWE)

CWE-79

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Threat summary

Active exploitation appears in 1 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
47 mentions across 11 observed days

What's happening

Active exploitation reported across 1 signal
Exploit tool or code specified in 7 signals
PoC mentioned or linked in 16 signals
Patch or workaround mentioned in 27 signals
Technical details provided in 39 signals
Disclosure: 8 classified signals
Peaked 8d ago at 22 mentions (2026-09-22); latest day: 1
47 total mentions across 11 days

Deep dive

Activity timeline47 mentions / 11d

Signal classification6 categories

Patch

2042.6%

PoC

1021.3%

Disclosure

817.0%

General

48.5%

Exploit

48.5%

Active Exploitation

12.1%

Referenced assets27 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-18	3	Patch3
2026-09-21	1	Patch1
2026-09-22	22	Disclosure7General4Patch11
2026-09-23	4	Active Exploitation1Patch2PoC1
2026-09-24	2	Patch1PoC1
2026-09-25	6	Exploit2Patch1PoC3
2026-09-26	3	PoC3
2026-09-27	3	Disclosure1PoC2
2026-09-30	1	Exploit1
2026-10-19	1	Patch1
2026-10-26	1	Exploit1

Full discourse20 posts

The Hacker News@TheHackersNews41d
Disclosure
‼️WordPress "Comment2Shell" vulnerability (CVE-2026-93485) can turn an anonymous comment into server code execution through a logged-in admin session. The chain starts as stored XSS, fires when the page loads, and can use the admin’s session to upload a web shell. Details → https://thehackernews.com/2026/09/wordpress-comment2shell-flaw-can-turn.html
Post summary
The tweet announces CVE-2026-93485 ('Comment2Shell') as a WordPress vulnerability chaining stored XSS to RCE via admin session web shell upload, links to a news article for more details, but does not mention a PoC, exploit tool, patch, or active exploitation.
13851136515361.6K
2.4M followersView on X
elhacker.NET@elhackernet38d
Patch
Vulnerabilidad Comment2Shell permite controlar sitios de WordPress mediante comentarios Administradores de WordPress deben parchear una vulnerabilidad grave del núcleo (CVE-2026-93485) que permite la ejecución de comandos en el servidor a través de comentarios anónimo https://blog.elhacker.net/2026/09/vulnerabilidad-comment2shell-permite.html
Post summary
The tweet reports a critical WordPress vulnerability (CVE‑2026‑93485) that allows remote code execution through anonymous comments and urges administrators to apply the available patch.
3373146628.7K
142.5K followersView on X
高杉＠沼を駆けだすエンジニア@takasugi_mbsjk14d
Patch
例えば記事編集しやすいCMS、wordpressを利用していたと仮定した場合直近だけでも CVE-2026-87902 CVE-2026-93485 WordPress Core 4.7.0 - 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Imgur oEmbed WordPress Core 7.1 - 7.1.2 - Unauthenticated Stored Cross-Site Scripting via Pending Comments WordPress Core 6.5.0 - 7.1.2 - Authenticated (Author+) Second-Order SQL Injection via WXR Export WordPress Core 4.7.0 - 7.1.2 - Authenticated (Author+) Unauthorized Sticky Post Modification via REST API CVE-2026-66666 といった脆弱性が発見されて修正パッチが公開されたりしているのね。そうした脆弱性への対応を医師や事務員にさせるぐらいならば、維持費25000円で外注した方が安いのですよ。維持費安すぎですねぇ。
Post summary
The text discusses multiple WordPress CVEs with specific technical vulnerability details (XSS, SQLi, privilege escalation) and explicitly notes that correction patches have been released, recommending outsourcing maintenance as a cost-effective alternative to in-house patching.
9135712122.0K
2.8K followersView on X
Syed Wajeeh-ul-Hassan Rizvi@0xDeathShotXD39d
Exploit
Comment2Shell - CVE-2026-93485 PoC Exploit Zero-click pre-auth RCE on WordPress One comment → Shell ⭐ https://github.com/DeathShotXD/Comment2Shell #EthicalHacking #WebSecurity #XSS #ZeroDay #Hacking #Pentesting #PoC #InformationSecurity #WordPress #RCE #InfoSec #BugBounty #CyberSecurity #Pwn https://t.co/SQ1He8SLVA
Post summary
The tweet announces and shares a GitHub repository titled 'Comment2Shell PoC Exploit' for CVE-2026-93485, describing a zero-click pre-auth RCE on WordPress, with the main takeaway being the availability of exploit code.
110046473.3K
89 followersView on X
!Manan@0xManan38d
PoC
PoC is public. One anonymous WordPress comment can become a shell. CVE-2026-93485 (Comment2Shell): wpautop() turns a blockquote cite newline into a live onfocus handler. Admin opens the post → plugin zip uploads through their session → www-data RCE. Chain: unauth comment → KSES-allowed blockquote cite with \n → wpautop injects <p> mid-attribute → wptexturize leaves a raw " inside <code> → autofocus XSS → /wp-admin/update.php?action=upload-plugin → shell.php?c=id No click needed after the admin loads the page. Block themes (and some classic comment blocks) light it. Full chain PoC (scanner + interactive shell + Nuclei + Docker lab): https://github.com/DeathShotXD/Comment2Shell Write-up (mechanism + curl PoC): https://idnsec.com/research/comment2shell-zero-click-pre-auth-xss-to-rce-in-wordpress-core/ tip: stock comment_moderation is off. Reusing the default "A WordPress Commenter" identity skips first-time approval. If you're still below 7.1.1 / your branch's backport, treat comments as an unauth foothold until you prove otherwise.
Post summary
A PoC for CVE-2026-93485 (Comment2Shell), detailing a zero-click XSS-to-RCE chain in WordPress, is publicly available with linked tools, code, and technical write-up. The text emphasizes pre-auth exploitation and advises immediate patching.
310041182.6K
2.3K followersView on X
Entre Kaczynski y Chinaski@686f6c6136d
PoC
Monté otro laboratorio para destripar CVE-2026-93485 (Comment2Shell) o cómo un comentario sin autenticar en WordPress puede pasar de XSS almacenado a ejecución remota de código. Incluye root cause auto-verificado, control 7.1.1 y la vía Post2Shell. https://686f6c61.github.io/POC-WP-CORE-CVE-2026-93485/
Post summary
The tweet announces a lab analysis of CVE‑2026‑93485 and provides a link to a proof‑of‑concept page, indicating a PoC is available.
3203292.1K
3.5K followersView on X
Entre Kaczynski y Chinaski@686f6c6137d
PoC
He montado otro lab Docker en este caso para Comment2Shell. De como un comentario anónimo en WordPress se vuelve XSS zero-click y de ahí a RCE. Con el root cause sobre el código real 7.1.0 vs 7.1.1 y mi humilde aportación al campo y vulnerabilidad. https://github.com/686f6c61/POC-WP-CORE-CVE-2026-93485
Post summary
The author shares a Docker lab environment and a GitHub PoC repository (Comment2Shell) demonstrating a WordPress vulnerability chain from anonymous comment to zero-click XSS to RCE, including root cause analysis of versions 7.1.0 vs 7.1.1.
3211973.1K
3.5K followersView on X
pdnuclei-bot@pdnuclei_bot7d
Exploit
🚨 CVE-2026-93485 - high 🚨 WordPress Core < 7.1.1 - Unauthenticated Stored XSS via Comment (Comment2Shell) > WordPress core before 7.1.1 is vulnerable to unauthenticated stored XSS via crafted b... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-93485 @pdnuclei #Nuclei...
Post summary
The post reports CVE-2026-93485 affecting WordPress Core before 7.1.1 with unauthenticated stored XSS via comment, and links to ProjectDiscovery/Nuclei references; no active exploitation or explicit patch guidance was stated.
050164676
1.4K followersView on X
Welsh ICP Conviction 🏴󠁧󠁢󠁷󠁬󠁳󠁿🏉@ICPLEGEND196641d
Patch
🚨 internet-computer:native — ANOTHER REMINDER OF HOW MANY DOORS EXIST IN THE TRADITIONAL WEB STACK. ♾️🛡️ A newly disclosed WordPress core vulnerability, “Comment2Shell” (CVE-2026-93485), shows how something as simple as an anonymous COMMENT could potentially become: 💬 Malicious comment → 💉 Stored XSS → 👤 Administrator opens page → 🔑 Admin session abused → 📦 Malicious plugin uploaded → 💻 Remote code execution No administrator password necessarily needs to be stolen. The attacker potentially weaponizes the TRUST already granted to the administrator's session. WordPress has patched the vulnerability and there is currently NO evidence it has been exploited in the wild. But look at the bigger architectural lesson. Traditional applications can depend on: 🖥️ Servers ⚙️ Operating systems 🌐 Web servers 🗄️ Databases 🔌 Plugins 🔑 Administrator accounts 🔥 Firewalls ☁️ Cloud infrastructure Every layer creates another security boundary that must be defended. This is why internet-computer:native by @dfinity interests me so much. ♾️ Tamper-resistant canisters 🛡️ Replicated execution 🔐 Cryptographic authorization ☁️ Sovereign Cloud Engines ⚙️ No conventional server administration for canister applications 🌍 Resilience built into the protocol internet-computer:native doesn't eliminate software vulnerabilities. It attacks something arguably even more important: THE COMPLEXITY AND ATTACK SURFACE OF THE INFRASTRUCTURE UNDERNEATH THE APPLICATION. The future isn't simply patching yesterday's internet faster. IT'S BUILDING A BETTER ARCHITECTURE. ♾️🔥 @dfinity @OccupyDemocrats #ICP #InternetComputer #CyberSecurity #CloudEngines #CyberResilience #SovereignCloud ♾️ Support my internet-computer:native content: 1e672d038cebc619d93186418fa98f6499dbdb9cfdfac54f366c61a4a4ee4362
Post summary
The text discloses a new WordPress vulnerability (CVE-2026-93485) and confirms that a patch has been issued, while using the disclosure to promote an alternative architecture (Internet Computer). No active exploitation or PoC is reported.
100180469
1.8K followersView on X
Ryx@PadhiyarRushi38d
PoC
WordPress "wpautop()" turns a comment into stored XSS, then an admin session into PHP! CVE-2026-93485 / Comment2Shell: Unauthenticated stored XSS in "wpautop()" on block themes and some classic block-render paths. Page load fires the handler. From there the usual plugin-upload path is RCE in the admin browser. Fixed in 7.1.1, backported to 4.7.36+. Writeup Sept. 21 https://idnsec.com/research/comment2shell-zero-click-pre-auth-xss-to-rce-in-wordpress-core/ #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #WordPress #XSS #RCE
Post summary
This post discloses CVE-2026-93485 (Comment2Shell), a pre-auth stored XSS in WordPress's wpautop() that escalates to RCE via the admin session. A linked research writeup provides technical details, and a fix in 7.1.1 is noted.
300105658
954 followersView on X
Rafie M@yeraisci_42d
Patch
Comment2Shell : Zero-Click Pre-Auth XSS to RCE in WordPress Core. Reproducible on a default installation. CVE-2026-93485. Patched in version 7.1.1. Make sure to update your sites ASAP. https://idnsec.com/research/comment2shell-zero-click-pre-auth-xss-to-rce-in-wordpress-core/
Post summary
The post discloses CVE-2026-93485 (a zero-click XSS-to-RCE vulnerability in WordPress Core), provides a link to a technical analysis, and explicitly names a patched version (7.1.1) with a recommendation to update. While the linked content may include a PoC, the primary focus is on the patch and remediation.
11077300
416 followersView on X
connect24h@connect24h41d
Disclosure
見回り役の権限を使うとは、嫌らしい。The Hacker Newsが報じたWordPressの「Comment2Shell」（CVE-2026-93485）は、匿名コメントのXSSから管理者セッションを介し、サーバー上のRCEに至り得るという。成立にはコメントの表示やテーマ構成、ログイン済み管理者の閲覧が絡む。匿名で投稿しただけで即RCE、という話ではない。私が気になるのは、不審なコメントを調べる担当者が、どの権限でページを開くかだ。記事にあるコメント承認と保留回避の説明も、この閲覧経路と重ねて読みたい。調査のために開くその画面に、管理者権限まで持ち込んでいないか。 https://thehackernews.com/2026/09/wordpress-comment2shell-flaw-can-turn.html
Post summary
Analyst commentary on WordPress CVE-2026-93485 (Comment2Shell) outlining the XSS-to-RCE chain and conditional prerequisites, with emphasis on reviewer privilege concerns; no PoC, exploit, patch, or active exploitation is cited.
10072684
9.0K followersView on X
kokumօtօ@__kokumoto38d
PoC
WordPress 7.1.1で修正されたComment2Shell脆弱性(CVE-2026-93485)に対応するPoC（攻撃の概念実証コード）が公表された。wpautop()フォーマット関数における無認証蓄積型クロスサイトスクリプティング。管理者に表示させると遠隔コード実行可能。 https://cybersecuritynews.com/wordpress-comment2shell-vulnerability/
Post summary
A proof-of-concept exploit for the Comment2Shell vulnerability (CVE-2026-93485) in WordPress has been published, showing an unauthenticated stored XSS in wpautop() that can lead to remote code execution. The flaw was patched in WordPress 7.1.1.
00044931
7.8K followersView on X
Rıdvan Yağlı@ridvanyagli38d
Exploit
🔴 WordPress Core'daki CVE-2026-93485 açığı, kimlik doğrulaması gerektirmeden gönderilen kötü amaçlı yorumun wpautop() üzerinden stored XSS olarak çalıştırılmasına olanak tanıyor. Yayınlanan PoC ise bu XSS'i admin oturumunda tetikleyerek plugin yükleme üzerinden RCE'ye kadar ilerleyen saldırı zincirini gösteriyor. PoC: https://github.com/DeathShotXD/Comment2Shell Diğer scanner PoC: https://github.com/0xBlackash/CVE-2026-93485
Post summary
The text details CVE-2026-93485, an unauthenticated stored XSS in WordPress core that can lead to RCE, and provides links to functional exploit code on GitHub.
00052443
2.5K followersView on X
dbugs@ptdbugs38d
PoC
A PoC/exploit has been discovered for vulnerability CVE-2026-93485 PT ID: PT-2026-95257 Vendor: Automattic Product: WordPress Description: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Automattic WordPress core allows DOM-Based XSS. The Unauthenticated Stored XSS vulnerability in the WordPress core can be reproduced on a default WordPress installation. Comment moderation is disabled by default, and the requirement for commenters to have a previously approved comment can be bypassed. References: • https://dbu.gs/vulnerability/PT-2026-95257 • https://github.com/deathshotxd/comment2shell
Post summary
A PoC has been discovered and linked for CVE-2026-93485, a DOM-based XSS in WordPress core enabling unauthenticated stored XSS via comment moderation bypass. The post focuses on the availability of a GitHub PoC rather than active exploitation or patches.
02031511
3.7K followersView on X
MagicWP@magicwp_io41d
Patch
Comment2Shell (CVE-2026-93485): an anonymous blog comment that becomes server code execution, fixed in WordPress 7.1.1. → Unauthenticated stored XSS in core's wpautop() function, CVSS 7.1 → Payload goes in through the normal comment form and passes WordPress's content filters → Only exploitable on sites using a block theme (or classic theme calling the_content()) → If an admin views the comment, the script can escalate to a full shell → Fix: update to WordPress 7.1.1 https://magicwp.io/blog/comment2shell-cve-2026-93485 #WordPress #WordPressSecurity
Post summary
The text discloses CVE-2026-93485, describing an unauthenticated stored XSS in WordPress's wpautop() function (CVSS 7.1) that can escalate to remote code execution when an admin views a malicious comment, and explicitly recommends updating to WordPress 7.1.1 as remediation.
1004186
15 followersView on X
HOL@HashgraphOnline45d
Patch
A stranger can leave script in your WordPress comments. Core bug. WordPress 7.1.1 closes CVE-2026-93485 plus 10 other security fixes. Update now. https://hol.org/blog/cve-2026-93485-wordpress-711-unauth-comment-xss https://t.co/jhdL2oWdAD
Post summary
The text announces CVE-2026-93485 as an unauthenticated comment XSS vulnerability in WordPress and directs users to update to WordPress 7.1.1 as the remediation, making the patch the primary takeaway.
111301.1K
19.2K followersView on X
DEGEN 👑@iamjustape34d
Exploit
Good Morning A full, ready-to-use exploit tool for a WordPress core flaw just went public on GitHub. Interactive shell, Nuclei scanner template, Docker container all included. CVE-2026-93485 Comment2Shell, patched Sept 17. The patch has been out 2 weeks. The barrier to exploiting it just dropped to run this tool.
Post summary
A ready-to-use exploit tool for CVE-2026-93485 (Comment2Shell) has been released on GitHub, lowering the barrier to exploitation, while a patch has been available for two weeks.
20030130
3.9K followersView on X
Aikido Community Japan@AikidoCommJP38d
PoC
昨日、WordPress本体の脆弱性「Comment2Shell」のPoCが公開された。 CVE-2026-93485、CVSS 7.1。匿名で悪性コメントを1件投稿。あとは管理者が、自分のサイトでそのコメントを見るだけ。 Stored XSSが発火し、管理者の権限を使って悪性プラグインをアップロード。最終的にはサーバー上でコマンド実行まで到達する。前回のClick2Shellは、管理者に攻撃者が用意したリンクを踏ませる必要があった。今回は、管理者の日常的な「コメント確認」そのものが引き金になる。脆弱性自体は9/17公開のWordPress 7.1.1で修正済み。ただし現在の最新版は7.1.2なので、今更新するなら7.1.2へ。旧系列も9/22付の最新バックポート版まで更新を。現時点で実悪用の報告はないが、PoC、スキャナ、Nucleiテンプレートまで公開された。週末ですが、WordPressでコメントを使っているならバージョンだけ確認しておいた方がいい。 #WordPress #Comment2Shell #CVE202693485 #脆弱性 #サイバーセキュリティ
Post summary
A PoC for the WordPress Comment2Shell vulnerability (CVE‑2026‑93485) has been published, showing that a malicious comment can trigger stored XSS leading to admin‑level plugin upload and remote code execution; the issue is already patched in WP 7.1.1 and back‑ported to older versions, with no confirmed active exploitation.
20011840
885 followersView on X
Rafie M@yeraisci_40d
Patch
Comment2XSS : Zero-Click Pre-Auth XSS to Potential RCE in WordPress Core. Reproducible on a default installation. CVE-2026-93485. Patched in version 7.1.1. Make sure to update your sites ASAP. https://idnsec.com/research/comment2xss-zero-click-pre-auth-xss-to-rce-in-wordpress-core/
Post summary
The text discloses a vulnerability (CVE-2026-93485: XSS to RCE in WordPress Core) and emphasizes that it is patched in version 7.1.1, urging immediate updates as remediation.
01030235
422 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-93485

高杉＠沼を駆けだすエンジニア[verified]@takasugi_mbsjkPatch

The text discusses multiple WordPress CVEs with specific technical vulnerability details (XSS, SQLi, privilege escalation) and explicitly notes that correction patches have been released, recommending outsourcing maintenance as a cost-effective alternative to in-house patching.

!Manan[verified]@0xMananPoC

A PoC for CVE-2026-93485 (Comment2Shell), detailing a zero-click XSS-to-RCE chain in WordPress, is publicly available with linked tools, code, and technical write-up. The text emphasizes pre-auth exploitation and advises immediate patching.

Entre Kaczynski y Chinaski[verified]@686f6c61PoC

The tweet announces a lab analysis of CVE‑2026‑93485 and provides a link to a proof‑of‑concept page, indicating a PoC is available.

Entre Kaczynski y Chinaski[verified]@686f6c61PoC

The author shares a Docker lab environment and a GitHub PoC repository (Comment2Shell) demonstrating a WordPress vulnerability chain from anonymous comment to zero-click XSS to RCE, including root cause analysis of versions 7.1.0 vs 7.1.1.

Welsh ICP Conviction 🏴󠁧󠁢󠁷󠁬󠁳󠁿🏉[verified]@ICPLEGEND1966Patch

The text discloses a new WordPress vulnerability (CVE-2026-93485) and confirms that a patch has been issued, while using the disclosure to promote an alternative architecture (Internet Computer). No active exploitation or PoC is reported.

Ryx[verified]@PadhiyarRushiPoC

This post discloses CVE-2026-93485 (Comment2Shell), a pre-auth stored XSS in WordPress's wpautop() that escalates to RCE via the admin session. A linked research writeup provides technical details, and a fix in 7.1.1 is noted.

connect24h[verified]@connect24hDisclosure

Analyst commentary on WordPress CVE-2026-93485 (Comment2Shell) outlining the XSS-to-RCE chain and conditional prerequisites, with emphasis on reviewer privilege concerns; no PoC, exploit, patch, or active exploitation is cited.

kokumօtօ[verified]@__kokumotoPoC

A proof-of-concept exploit for the Comment2Shell vulnerability (CVE-2026-93485) in WordPress has been published, showing an unauthenticated stored XSS in wpautop() that can lead to remote code execution. The flaw was patched in WordPress 7.1.1.