WordPress has fixed a serious vulnerability in its core software, known as Comment2Shell, that allowed an anonymous user to post comments containing hidden scripts. These scripts could be triggered into executing remote code if viewed by a logged-in administrator. The flaw was patched on September 17 in version 7.1.1 and rated 7.1/10 on the CVSS scale — site owners are strongly urged to update immediately.
How the vulnerability works
The problem unfolds in the gap between how WordPress saves comments and how it later displays them. When someone submits a comment, WordPress checks for dangerous HTML. Later, when rendering the page, it reformats the comment. The issue arose when an attacker inserted a line break inside an attribute of an allowed HTML tag. During the rendering phase, WordPress split the tag and relocated part of the attacker’s input into a place where the browser treated it like an event handler — which fires automatically when the page loads, no click required.
The script runs with whatever privileges belong to the person who opens the page: normal visitors are limited, but if a page with such a comment is viewed by an administrator, the attacker can hijack that session. The malicious code could then install a plugin acting as a web shell — enabling arbitrary commands to run on the server. The issue is limited to sites using block themes or classic themes that handle comments in a certain way.
Exploitability, reach, and mitigation
The flaw affects WordPress versions from 4.7 through 7.1. The patched builds are:
- 7.1 → update to 7.1.1
- 7.0 → 7.0.5
- 6.9 → 6.9.8
- Older branches back to 4.7 → update to their latest fixed release
WordPress notes that the comment must appear publicly, which requires moderation to be disabled or bypassed. Many sites leave both off by default, making the flaw more accessible than one might assume. A web application firewall or security plugin might help block crafted comments temporarily.
This was the only flaw fixed in this update that could be exploited without any user account. Other fixes still required at least some level of access.
The same release also addressed another vulnerability dubbed Click2Shell, where a malicious link could force a theme to be installed. Alongside Click2Shell were several other critical bugs from earlier in the year — one allowing remote code execution with zero login; another enabling code execution via the login page.
What site owners should do now
First and foremost: upgrade your WordPress installation to 7.1.1 or whatever the newest version is for your branch. If you can’t update immediately, disable comments across your site or at least disable new comment submissions until you can patch. Also scan for unrecognized plugins or files in case the flaw has already been exploited.
Why this matters: this flaw unexpectedly elevated a simple XSS — which normally just affects the browser of whoever sees it — into full remote code execution on the server, but only via an admin session. It highlights the danger posed by compositional gaps in software sanitization logic and the risks when standard features like commenting and themes interact in unsafe ways.
This vulnerability compels site operators to rethink how moderation, comment settings, and theme practices are deployed. With attackers proving time and again that they can combine “harmless” vulnerabilities into devastating chains, the best defense remains patching promptly and minimizing exposure from dormant and default features.
