A newly discovered vulnerability in WordPress, known as Comment2Shell, is putting millions of websites and their administrators at risk. The flaw allows an attacker who can inject malicious code through anonymous comments on a site to gain access to administrative sessions, potentially leading to devastating consequences for website security.
The Comment2Shell bug is a classic example of a cross-site scripting (XSS) vulnerability, which occurs when a website fails to properly sanitize user input. In this case, an attacker can exploit the flaw by injecting malicious JavaScript code into comments on a WordPress site. While most commenters are anonymous and their IP addresses not tracked, Comment2Shell allows attackers to inject code that is executed in the context of an administrative session.
This happens because WordPress’s default settings allow anyone to comment without logging in or registering for an account. Once the malicious code is injected into a comment, it can be triggered by any visitor to the site who has JavaScript enabled, but only if they are using a browser configured to allow third-party cookies (a setting that is commonly enabled). If the site’s administrator happens to log in while the attacker’s code is still executing, the attacker gains access to the admin session and can take control of the website.
The Comment2Shell flaw has significant implications for any WordPress site with multiple administrators or those using shared hosting. If an attacker gains access to an administrative session on one of these sites, they may be able to pivot to other areas of the network where more sensitive data is stored. This could potentially lead to a wider breach, exposing sensitive information such as email addresses, passwords, and financial details.
The Comment2Shell vulnerability affects not just individual websites but also entire networks when multiple WordPress sites are hosted on shared infrastructure. The bug can also be used in conjunction with other vulnerabilities or exploits to create a more complex attack scenario. This is particularly concerning for businesses that rely heavily on their online presence and have multiple WordPress installations across different properties.
To mitigate the risk of an attacker exploiting Comment2Shell, website administrators should take immediate action. First and foremost, update all WordPress sites to the latest version, as patches are available for this vulnerability. It’s also essential to review comment settings and consider requiring login or registration before commenting on sensitive posts. Furthermore, administrators should implement stricter cookie policies, such as disabling third-party cookies altogether, to prevent attackers from executing malicious code.
Ultimately, the Comment2Shell flaw serves as a stark reminder of the importance of keeping software up-to-date and implementing robust security measures. As website owners and administrators, it’s crucial to stay vigilant and proactive in addressing potential vulnerabilities before they can be exploited by attackers.
Source: The Hacker News — 2026-09-22