WordPress Core XSS Flaw Enables RCE via Admin Sessions

A stored cross-site scripting flaw in WordPress core, identified by researchers as “Comment2Shell,” lets an unauthenticated visitor plant a malicious script through the comment form. When an administrator later opens the page containing that comment, the script executes in the admin’s browser session, and that session carries enough server-side privilege to enable remote code execution on the host.

The vulnerability is in WordPress core, not a plugin. That distinction matters. Most WordPress security coverage tracks third-party plugins, and reasonably so: the plugin ecosystem carries a large share of the platform’s attack surface. A flaw in core applies to every WordPress installation that hasn’t applied a fix, regardless of theme or plugin configuration. WordPress powers a substantial fraction of the public web.

The Hacker News reported the flaw on Monday, citing the “Comment2Shell” name given by the researchers who found it. No CVE identifier had been publicly assigned at time of publication.

The attack has no credential requirement for the initial step. Anyone who can submit a comment can deliver the payload. The admin session is the trigger: the script does nothing until a privileged user opens the relevant page. That is a well-understood XSS escalation pattern, and the WordPress plugin ecosystem has seen it before in payment plugin flaws and events-calendar RCEs. Reaching it through a core comment-handling path gives it wider applicability than any individual plugin flaw, since there is no mitigation through selective plugin removal.

What administrators should do

Apply any available security updates. WordPress delivers security patches through automatic background updates on most installations, but sites with auto-updates disabled should check their dashboard immediately.

Review comment approval settings. Requiring comments to pass moderation before appearing publicly prevents unreviewed submissions from ever reaching a page the admin opens. This breaks the delivery mechanism for the attack and is a reasonable default regardless of patch status.

For larger installations, adding WAF rules to detect script-containing comment submissions can reduce exposure during the window between disclosure and patch availability.

WordPress’s security team had not published a patch or CVE assignment at the time this piece was filed. Patch timelines for core RCEs have typically been short. This article will be updated when fix details are available.