WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session
A new vulnerability, dubbed ‘Comment2Shell,’ in WordPress allowed an anonymous visitor to inject a script that, when viewed by a logged-in administrator, could be used to upload a web shell and execute commands on the server. While not actively exploited, the flaw stemmed from a gap in WordPress’s comment processing and could be bypassed by disabling comment moderation. WordPress has released version 7.1.1 to address the issue, and users are advised to update immediately.
A new security flaw, known as ‘Comment2Shell,’ has been discovered in WordPress core, allowing an anonymous visitor to plant a malicious script on a WordPress page. If a logged-in administrator subsequently viewed the page, the script could be executed on the server, granting an attacker control. The vulnerability arose due to a gap in WordPress’s comment processing: the system checks for dangerous HTML when saving a comment, but doesn’t fully sanitize it when displaying the comment.
Rafie Muhammad, the security researcher who reported the bug, demonstrated how a simple line break within an allowed HTML tag could trigger the vulnerability. When WordPress reformatted the comment for display, it inadvertently moved the attacker’s code into a location where it was treated as a live event handler, executing automatically without requiring a click. The script then leveraged the administrator’s session to upload a plugin containing a web shell, a small file that executes commands sent by the attacker.
The vulnerability was dependent on how the site displayed its comments, specifically on sites using block themes or classic themes that formatted comments in a similar way. Crucially, comment moderation is typically disabled by default, and can be bypassed, meaning a comment could reach the page without approval. Patchstack rated the flaw as a 7.1 out of 10 on the CVSS scale.
WordPress 7.1.1 has been released to address this issue, and users are strongly advised to update to the latest version. Older versions affected include 4.7 through 7.1, with fixed releases available for each branch back to 4.7.36. Sites unable to update immediately can mitigate the risk by disabling comments on posts or across the entire site. A web application firewall or a security plugin may also block the crafted comment.
This vulnerability is not the only security issue affecting WordPress this year. In July, a separate flaw, wp2shell, allowed attackers to run code without needing an account, and was later listed as actively exploited by U.S. authorities. In August, another flaw in the login page allowed researchers to execute code as an administrator. These flaws are distinct from the Comment2Shell vulnerability.