WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session

Kurzinfo

Metadaten

  • Original (extern): Link oeffnen
  • Veroeffentlicht: 2026-09-22 06:03 UTC
  • Importiert: 2026-09-26 18:57 UTC
  • CVSS: 7.1
  • Quelle-ID: thn_global
  • uid_hash: 828f3a7f83d66c34b1f47599094c75bfbc6da261203e056178751169c51eb8cf
The Hacker News

Inhalt

A new flaw in WordPress core let an anonymous visitor leave a comment that planted a hidden script on the page. If a logged-in administrator later opened that page, the script could run code on the site's server.

WordPress fixed the flaw, tracked as CVE-2026-93485 and called "Comment2Shell," on September 17 in version 7.1.1 and told site owners to update right away. There is

Verknuepfte CVEs

CVE-ID Severity (Quelle) CVSS (Quelle) Severity (CVE.org) CVSS (CVE.org) EPSS EPSS-Pctl Veroeffentlicht (CVE.org)

CVE-2026-93485

HIGH

7.1

HIGH

7.1

2026-09-18

Quellen-Details

Bezeichnung Name Kategorie Tags Zielgruppe Sprache Feed-URL
The Hacker News

thn_global

 security_news - de https://feeds.feedburner.com/TheHackersNews
Zurueck zur Eintrags-Liste