Security2 hSeptember 22, 2026, 13:03

WordPress Comment2Shell flaw turns anonymous comment XSS into RCE

A flaw in WordPress core, tracked as CVE-2026-93485 and dubbed "Comment2Shell," let an anonymous visitor post a comment that planted a hidden script on the page. If a logged-in administrator opened it, the script could run code on the site's server. WordPress fixed the issue on September 17 in version 7.1.1 and urged site owners to update immediately.

The Hacker News Open source

Flaw tracked as CVE-2026-93485, dubbed Comment2Shell
Anonymous comment planted a hidden script on the page
Script ran server-side code when an admin opened the page
Fixed on September 17 in WordPress version 7.1.1

#WordPress

EU auditors: poor information sharing between member states creates security gaps

Security

Anthropic reports autonomous AI-agent attacks as physical AI security demand grows

Security

Mimecast: security effectiveness drops despite higher spending

Security

WordPress Comment2Shell flaw turns anonymous comment XSS into RCE

EU auditors: poor information sharing between member states creates security gaps

Anthropic reports autonomous AI-agent attacks as physical AI security demand grows

Mimecast: security effectiveness drops despite higher spending

5G-Shark: cheap fake base station still tracks 5G subscribers