# Comment2Shell: Unauthenticated Stored XSS-to-RCE Chain in WordPress wpautop() (CVE-2026-93485) > The public "Comment2Shell" PoC chains an unauthenticated stored XSS in WordPress core's wpautop() comment-formatting logic into remote code execution: a newline hidden inside a blockquote cite attribute survives KSES sanitization, and a regex in wpautop() that stops at the first '>' injects a stray tag that lets onfocus/autofocus fire JavaScript the instant an administrator views the comment. That zero-click script then steals the plugin-install nonce, builds a plugin ZIP in-browser, and uploads a self-deleting PHP webshell. Affects WordPress 4.7 through 7.1.0; fixed in 7.1.1 with backports down to 4.7.36. - **Published:** 2026-09-27T00:00:00Z - **Last reviewed:** 2026-09-27T00:00:00Z - **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2717 - **ID:** TL-2026-2717 - **Severity:** HIGH (CVSS 7.1) - **Category:** VULNERABILITY - **Status:** ACTIVE - **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier) - **CVEs:** CVE-2026-93485 ## Description CVE-2026-93485 ("Comment2Shell") is a five-step exploit chain in WordPress core that turns an anonymous blog comment into full remote code execution on the underlying server. The chain begins at the input layer: WordPress's KSES HTML sanitizer allows the `cite` attribute on an allow-listed `
` element, but its encoding map does not account for a raw newline character, so a comment body containing `
x" onfocus=... autofocus
` is stored verbatim. The vulnerability is purely a display-time bug, not an input-validation gap: the same content is safe as stored text and only becomes dangerous when WordPress re-renders it. At render time, `wpautop()` (wp-includes/formatting.php, line 563 in vulnerable releases) converts the embedded newline into an HTML-comment placeholder. The function's tag-matching regex, `|

]*)>|i`, uses a `[^>]*` character class that cannot traverse a quoted attribute boundary, so it stops at the first bare `>` -- the closing bracket of the injected placeholder comment -- and mis-inserts a `

` tag in the middle of the `cite` attribute. `wptexturize()` then treats that misplaced `

` as a real tag boundary and re-encodes straight quotes as curly-quote entities everywhere except inside the attacker's `` block, which finalizes a syntactically valid `onfocus`/`autofocus` attribute pair in the resulting DOM. Because `autofocus` fires `onfocus` without any user gesture, the payload executes the instant a logged-in administrator's browser renders the comment moderation queue or the post itself -- true zero-click execution inside the admin's authenticated session. From there the injected JavaScript reads the `_wpnonce` value out of the `/wp-admin/plugin-install.php?tab=upload` form, constructs a ZIP archive entirely in browser memory containing a minimal WordPress plugin whose only file is a PHP web shell, and POSTs it to `/wp-admin/update.php?action=upload-plugin`. WordPress installs and the plugin directory becomes web-accessible immediately -- no activation step is required for the dropped PHP to execute, since the attacker can request it directly. The resulting shell supports arbitrary command execution via a `c` query parameter and, by default, self-deletes after use via a `d=1` parameter, unlinking its own PHP file and removing the plugin directory to erase the most obvious forensic artifact. An `--no-cleanup` flag in the public tooling can retain the shell for persistent access instead. Exploitation additionally depends on getting the payload in front of an administrator, which the researcher demonstrated can happen even under default moderation settings: reusing the identity of WordPress's default "A WordPress Commenter" seed record triggers auto-approval in `check_comment()`, disabling "comment author must have a previously approved comment" removes moderation entirely, and even a still-pending comment can be rendered to a victim who follows an attacker-supplied `?unapproved=&moderation-hash=` preview link. WordPress 7.1.1 (released 2026-09-17) fixed the root cause by replacing the vulnerable regex with a quote-aware alternation, `!

"']|"[^"]*"|'[^']*')*)>!i`, that correctly tracks quoted attribute boundaries and no longer breaks on an embedded comment placeholder. The fix, and ten unrelated security fixes, shipped simultaneously and was backported to every WordPress branch still receiving security support, down to 4.7.36. A dependency-free Python PoC (`comment2shell.py`) with scanning, exploitation, interactive-shell, and IOC-detection modes, plus a Nuclei template, was published publicly on GitHub six days after the patch, materially lowering the skill floor for exploitation. No confirmed in-the-wild exploitation or CISA KEV listing existed at the time of this research. ## MITRE ATT&CK - T1595.002 Vulnerability Scanning - T1588.005 Exploits - T1190 Exploit Public-Facing Application - T1059.007 JavaScript - T1059 Command and Scripting Interpreter - T1185 Browser Session Hijacking - T1036 Masquerading - T1070.004 File Deletion - T1505.003 Web Shell ## Sources - [WordPress Comment2Shell Vulnerability Lets Hackers Take Over Sites Through Comments](https://cybersecuritynews.com/wordpress-comment2shell-vulnerability/) - [Comment2Shell: zero-click pre-auth RCE exploit for WordPress CVE-2026-93485](https://github.com/DeathShotXD/Comment2Shell) - [Comment2XSS: Zero-Click Pre-Auth XSS to Potential RCE in WordPress Core](https://idnsec.com/research/comment2xss-zero-click-pre-auth-xss-to-rce-in-wordpress-core/) - [WordPress 7.1.1 Patches a Stored XSS Bug in wpautop() (CVE-2026-93485)](https://conicplex.com/blog/wordpress-7-1-1-patches-an-unauthenticated-stored-xss-bug-in-wpautop-cve-2026-93485/) - [WordPress 7.1.1 Maintenance and Security Release](https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/) - [Comment2Shell CVE-2026-93485: WordPress Comment XSS to RCE](https://magicwp.io/blog/comment2shell-cve-2026-93485) - [CVE-2026-93485 Detail](https://www.tenable.com/cve/CVE-2026-93485) - [CVE-2026-93485: CWE-79 Improper Neutralization of Input During Web Page Generation in Automattic WordPress](https://radar.offseq.com/threat/cve-2026-93485-cwe-79-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-029380b8d98ad4a6) ## Full data Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp Canonical: https://intel.threadlinqs.com/threat/TL-2026-2717