A Newly Discovered Flaw in WordPress Exposes Admin Sessions, Turning Anonymous Comments into Ransomware Goldmines
Security researchers have uncovered a critical vulnerability in WordPress, a popular content management system (CMS) used by millions of websites worldwide. The flaw, which has been dubbed “Comment2Shell,” allows an attacker to exploit a seemingly innocuous anonymous comment left on a blog or website and gain unauthorized access to the site’s admin session, ultimately granting them control over the entire system.
This vulnerability comes in two parts: first, a cross-site scripting (XSS) flaw is triggered when an attacker injects malicious code into a comment field. However, this alone would not typically allow the attacker to execute commands on the server. The real danger lies in how WordPress handles administrative sessions – by using a session identifier that can be manipulated through the comment field. When an attacker successfully injects the malicious code and exploits the admin session flaw, they are essentially handed the keys to the site’s kingdom.
The Comment2Shell vulnerability affects all versions of WordPress 4.x and later, making it a widespread issue. As many as 70 million websites could be vulnerable to this attack vector, including high-profile blogs and e-commerce sites that rely on WordPress for their online presence. This is particularly concerning given the rise in ransomware attacks targeting businesses and organizations.
For an attacker, exploiting the Comment2Shell flaw is relatively straightforward: they would need only leave a comment containing malicious code on a vulnerable site. From there, the attacker could access the admin session using the session identifier and execute commands on the server – essentially turning an anonymous comment into a backdoor for ransomware or other malware attacks.
Why does this matter? With millions of websites at risk, a successful Comment2Shell attack could have disastrous consequences for businesses and organizations relying on WordPress. The potential for financial loss is substantial, not to mention the reputational damage that would come with a high-profile data breach. Furthermore, the ease with which an attacker can exploit this flaw highlights the need for security awareness and vigilance among site administrators.
For site owners, this vulnerability serves as a stark reminder of the importance of keeping software up-to-date and patching vulnerabilities in a timely manner. Installing a reputable web application firewall (WAF) or intrusion detection system (IDS) would also help mitigate the risk of an attacker exploiting the Comment2Shell flaw. Regularly monitoring comments for suspicious activity, combined with robust password management practices, will further reduce the likelihood of a successful attack.
Source: The Hacker News — 2026-09-22