⚡ CVE-2026-93485 - Comment2Shell

🧬 Overview

CVE-2026-93485 is a high-severity cross-site scripting vulnerability affecting the WordPress core.

The vulnerability is described as improper neutralization of user-controlled input during web-page generation, resulting in DOM-based XSS / stored XSS behavior.

The published advisory states that an unauthenticated attacker can submit malicious comment content, which may subsequently execute in the browser of a user viewing affected content.

The issue is associated with WordPress comment handling and can affect installations using default comment configuration.

🔥 Vulnerability Snapshot

CVSS vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

The CVSS 7.1 rating and vector are reported by the GitHub Advisory Database and Ubuntu security tracker.

🎯 Attack Surface

The reported vulnerability involves the WordPress comment-processing/rendering path.

A simplified attack flow is:

┌───────────────┐
│ Unauthenticated│
│    Attacker    │
└───────┬───────┘
        │
        │ Malicious comment input
        ▼
┌────────────────────┐
│ WordPress Comment  │
│    Processing      │
└─────────┬──────────┘
          │
          │ Improper neutralization
          ▼
┌────────────────────┐
│ Stored Application │
│      Content       │
└─────────┬──────────┘
          │
          │ Victim views page
          ▼
┌────────────────────┐
│ Victim Browser     │
│    XSS Execution   │
└────────────────────┘

According to the published vulnerability description, the normal requirement for a commenter to have a previously approved comment can be bypassed under the affected conditions.

🧠 Technical Description

The underlying weakness is classified as:

CWE-79 — Improper Neutralization of Input During Web Page Generation

The vulnerability occurs when attacker-controlled input reaches a web-page generation path without adequate neutralization.

The reported issue is particularly relevant to the processing of WordPress comments and the handling of line breaks / generated HTML. CERT Santé's technical summary identifies the wpautop() processing path as relevant to the vulnerability.

Conceptually:

Attacker-controlled input
          │
          ▼
   Comment processing
          │
          ▼
      wpautop()
          │
          ▼
   HTML generation
          │
          ▼
 Insufficient neutralization
          │
          ▼
      Stored content
          │
          ▼
   Victim renders page

Demo

📦 Affected Versions

The advisory lists multiple vulnerable WordPress branches.

Current 7.x branches

7.1        < 7.1.1
7.0        <= 7.0.4
6.9        <= 6.9.7
6.8        <= 6.8.8
6.7        <= 6.7.7
6.6        <= 6.6.7
6.5        <= 6.5.10
6.4        <= 6.4.10
6.3        <= 6.3.10
6.2        <= 6.2.11
6.1        <= 6.1.12
6.0        <= 6.0.14

Legacy branches

5.9        <= 5.9.16
5.8        <= 5.8.15
5.7        <= 5.7.17
5.6        <= 5.6.19
5.5        <= 5.5.20
5.4        <= 5.4.21
5.3        <= 5.3.23
5.2        <= 5.2.26
5.1        <= 5.1.24
5.0        <= 5.0.27
4.9        <= 4.9.31
4.8        <= 4.8.30
4.7        <= 4.7.35

These affected ranges are documented by the GitHub Advisory Database and Debian security tracker.

🛡️ Mitigation

Recommended

Upgrade WordPress to a fixed release for your branch.

For the 7.1 branch, the documented fixed release is:

WordPress 7.1.1

The WordPress security/maintenance release was published on 17 September 2026.

Check the installed version:

wp core version

Or from the WordPress installation directory:

grep "wp_version" wp-includes/version.php

Example:

$ wp core version
7.1.1

🔎 Safe Detection

A defensive version check can identify potentially affected installations without submitting an XSS payload.

#!/usr/bin/env python3

from packaging.version import Version

FIXED_VERSION = Version("7.1.1")


def check_version(version: str):
    current = Version(version)

    if current < FIXED_VERSION:
        print(f"[!] Potentially affected WordPress version: {version}")
        print("[!] Upgrade to a fixed release.")
    else:
        print(f"[+] WordPress version {version} is >= 7.1.1")


if __name__ == "__main__":
    version = input("WordPress version: ").strip()
    check_version(version)

Note: This simplified checker is intended for the 7.1 branch. WordPress backport releases use branch-specific fixed versions, so production scanners should maintain a complete version matrix rather than treating 7.1.1 as a universal minimum.

🧪 Safe Research Methodology

A controlled lab assessment should use:

1. Deploy isolated WordPress instance
            │
            ▼
2. Determine exact WordPress version
            │
            ▼
3. Review comment configuration
            │
            ▼
4. Inspect affected processing path
            │
            ▼
5. Compare vulnerable vs patched release
            │
            ▼
6. Verify remediation

Recommended laboratory setup:

┌─────────────────────────────────────┐
│          Isolated Test Lab          │
│                                     │
│  ┌─────────────┐   ┌─────────────┐ │
│  │ Vulnerable  │   │   Patched   │ │
│  │ WordPress   │   │ WordPress   │ │
│  └──────┬──────┘   └──────┬──────┘ │
│         │                   │       │
│         └────────┬──────────┘       │
│                  ▼                  │
│           Behavioral Diff           │
└─────────────────────────────────────┘

This repository intentionally avoids weaponized payloads and focuses on defensive verification and patch validation.

🔬 Security Impact

Successful exploitation may allow attacker-controlled script execution in the security context of a vulnerable WordPress site.

Potential impact can include:

• Session-related data exposure
• Unauthorized actions performed through a victim's browser
• Modification of page content
• Access to information available to the victim
• Browser-side manipulation of WordPress functionality

The official CVSS assessment assigns Low impact to confidentiality, integrity, and availability, with user interaction required and scope changed.

🧰 Defensive Checklist

[ ] Identify WordPress version
[ ] Check whether the branch is affected
[ ] Upgrade to a fixed release
[ ] Review comment configuration
[ ] Enable comment moderation where appropriate
[ ] Review suspicious recent comments
[ ] Monitor web/application logs
[ ] Inspect unexpected HTML/JavaScript in comments
[ ] Review administrator sessions after suspected compromise
[ ] Re-test after patching

📊 CVSS Breakdown

📁 Repository Structure

CVE-2026-93485/
│
├── README.md
├── scanner/
│   └── wp_version_check.py
│
├── docs/
│   ├── technical-analysis.md
│   └── mitigation.md
│
├── screenshots/
│   └── lab/
│
├── research/
│   └── notes.md
│
└── LICENSE

⚠️ Disclaimer

This repository is intended for:

• Security research
• Authorized penetration testing
• Defensive validation
• Vulnerability management
• Educational laboratory environments

Do not test systems without explicit authorization.

No weaponized exploitation code is provided.

📚 References

• CVE: CVE-2026-93485
• CWE: CWE-79
• GHSA: GHSA-2pgq-4jch-68j8
• CVSS: 7.1 High
• Vendor: Automattic / WordPress

Official / Security References

• NVD — CVE-2026-93485
• WordPress — 7.1.1 Maintenance and Security Release
• GitHub Advisory Database — GHSA-2pgq-4jch-68j8
• Debian Security Tracker
• Ubuntu Security Tracker