WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session

A critical vulnerability in WordPress core, tracked as CVE-2026-93485 and dubbed 'Comment2Shell', allows anonymous visitors to inject malicious scripts via comments. When a logged-in administrator views the affected page, the script executes and can achieve remote code execution on the server. The attack chain requires no authentication for the initial injection, making it particularly dangerous. WordPress addressed the flaw on September 17 with the release of version 7.1.1. Site owners were urged to update immediately to mitigate risk. The vulnerability represents a stored XSS-to-RCE escalation path exploiting privileged admin sessions.