Act
active
WordPress Comment2Shell CVE-2026-93485: Anonymous XSS to RCE via Admin
- Engineer — Act: A public PoC on GitHub makes exploitation practical despite a low EPSS score; the anonymous-commenter-to-admin-RCE chain is severe. Patch WordPress core to version 7.1.1 immediately across all managed sites.
- SOC/IR — Plan: No confirmed in-the-wild exploitation yet, but the public PoC makes detection work urgent this quarter. Build rules to flag suspicious JavaScript payloads in WordPress comment submissions and unexpected server-side execution correlated with admin page visits.
- Leader — Skip
- Signals: CVE-2026-93485 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.