WordPress administrators are being advised to patch a high-severity core vulnerability that can transform anonymous comments into server-side command execution This article explores webshell disguised plugin. . A faulty regular expression stops at the first closing angle bracket, inserting a paragraph element inside the attribute.

Subsequent formatting causes the browser to interpret attacker-controlled onfocus and autofocus attributes, triggering JavaScript automatically upon page load. If the viewer is an administrator, the payload can access WordPress administrative functions, retrieve the plugin-installation nonce, construct a ZIP archive in the browser, and upload a webshell disguised as a plugin. A proof-of-concept script by Syed Wajeeh-ul-Hassan Rizvi executes commands, removing the PHP shell and plugin directory, thereby minimizing obvious traces.

Comment approval can limit immediate exposure, but it should not be treated as a security boundary because previously approved identities and preview behavior may allow crafted content to appear. CVE-2026-93485 carries a CVSS 3.1 score of 7.1 and affects WordPress releases from 4.7 through 7.1.0, with branch-specific patched builds extending back to 4.7.36. The Comment2Shell project packages the independently discovered issue into a dependency-free Python scanner, laboratory environment, exploit demonstration, Nuclei template, and IOC checker.

They should also inspect the wp_comments database for unusual blockquote, cite, onfocus, or autofocus combinations; review requests to wp-comments-post.php and wp-admin/update.php; and hunt for recently created, unfamiliar PHP files under wp-content/plugins.