importantSYS.SOURCE: The Hacker News• 2026-09-22T11:33:14+05:30

WordPress Comment2Shell Vulnerability Exploits XSS to Achieve RCE via Admin Session

#wordpress #vulnerability #rce #xss #security

A newly disclosed WordPress vulnerability (CVE-2026-93485) allows anonymous users to execute remote code via crafted comments that exploit XSS to gain administrator-level access. The flaw was patched in WordPress 7.1.1, requiring immediate updates to prevent potential server compromise.

A new flaw in WordPress core let an anonymous visitor leave a comment that planted a hidden script on the page. If a logged-in administrator later opened that page, the script could run code on the site's server.

WordPress fixed the flaw, tracked as CVE-2026-93485 and dubbed "Comment2Shell," on September 17 in version 7.1.1 and told site owners to update right away. The

Read original article

*** END OF TRANSMISSION ***

> AI ADOPTION AMONG YOUNG USERS (9-18) RAISES CONCERNS OVER CRITICAL THINKING DEVELOPMENT > APPLE REMOVES USER CONSENT OPTION FOR AI FEATURES IN MACOS 15.3 UPDATE > SIDECOPY APT GROUP EXPANDS TARGETING OF INDIAN ACADEMIA VIA REVERSERAT SPEAR-PHISHING > HIDDEN META MUSE SETTING ENABLES AI ASSISTANT BACKDOOR VIA DICTATION HIJACKING > GZIP AS A LANGUAGE MODELING APPROACH VIA COMPRESSION-PREDICTION EQUIVALENCE > WORDPRESS COMMENT2SHELL VULNERABILITY EXPLOITS XSS TO ACHIEVE RCE VIA ADMIN SESSION > MORPHOTONICS SECURES €40M TO SCALE NANOIMPRINT LITHOGRAPHY FOR AR DISPLAYS AND DATA CENTER OPTICS > ACTIVE EXPLOITATION OF ZYXEL AND VEEAM VULNERABILITIES ENABLES COMMAND EXECUTION AND SYSTEM ACCESS > 2019 USED THINKPAD PURCHASE GUIDE: FEATURES, RECOMMENDATIONS, AND EBAY DEAL STRATEGIES > MIMO-V2.6-PRO MODEL ANALYSIS: INTELLIGENCE, PERFORMANCE, AND COST EVALUATION> AI ADOPTION AMONG YOUNG USERS (9-18) RAISES CONCERNS OVER CRITICAL THINKING DEVELOPMENT > APPLE REMOVES USER CONSENT OPTION FOR AI FEATURES IN MACOS 15.3 UPDATE > SIDECOPY APT GROUP EXPANDS TARGETING OF INDIAN ACADEMIA VIA REVERSERAT SPEAR-PHISHING > HIDDEN META MUSE SETTING ENABLES AI ASSISTANT BACKDOOR VIA DICTATION HIJACKING > GZIP AS A LANGUAGE MODELING APPROACH VIA COMPRESSION-PREDICTION EQUIVALENCE > WORDPRESS COMMENT2SHELL VULNERABILITY EXPLOITS XSS TO ACHIEVE RCE VIA ADMIN SESSION > MORPHOTONICS SECURES €40M TO SCALE NANOIMPRINT LITHOGRAPHY FOR AR DISPLAYS AND DATA CENTER OPTICS > ACTIVE EXPLOITATION OF ZYXEL AND VEEAM VULNERABILITIES ENABLES COMMAND EXECUTION AND SYSTEM ACCESS > 2019 USED THINKPAD PURCHASE GUIDE: FEATURES, RECOMMENDATIONS, AND EBAY DEAL STRATEGIES > MIMO-V2.6-PRO MODEL ANALYSIS: INTELLIGENCE, PERFORMANCE, AND COST EVALUATION