[CVE-2026-93485] Comment2XSS: Zero-Click Pre-Auth XSS to Potential RCE in WordPress Core

Affects all WordPress installations from version 4.7.0 through 7.1.0 without requiring credentials or interaction beyond opening a post. Administrators should verify upgrading to 7.1.1 or backported releases, and monitor server logs for suspicious comment payloads and unexpected plugin uploads.

While remote code execution depends on runtime prerequisites like PEAR, the unauthenticated LFI primitive resides directly in WordPress Core and affects all major branches from 4.7.0 through 7.1.1.

WordPress powers a large share of internet-facing sites. The pre-auth login-screen XSS can execute JavaScript in the site origin after victim interaction and, under the documented conditions, be chained into impact on administrator sessions and the server. Upgrade to WordPress 7.0.3 or the corresponding patched maintenance branch, then review login activity, administrator sessions, and unexpected plugins or file changes. The current CVE record assigns CVSS 4.0 8.9 (High) and requires active user interaction; no active-exploitation signal is currently recorded.

Using HacktronAI's OpenAI Discourse hack disclosure, this article covers sandboxing, runtime protection, and AI-assisted defense to shrink the blast radius of RCE across interconnected apps.

Post-auth RCE in Cisco Smart Software Manager (CSSM): command injection in nginx certificate upload, where openssl checks run via childProcess.execSync. Cisco silently patched it in 10-202608.

WordPress deep dive: REST batch-route confusion plus a scalar SQL injection, bridged via the object cache, Customizer and nested REST dispatch, formed a pre-auth RCE chain—fixed in 7.0.2, 6.9.5 and 6.8.6.