# WordPress Comment2Shell Flaw Turns Anonymous Comment XSS Into RCE

A WordPress vulnerability dubbed Comment2Shell allows attackers to escalate a cross-site scripting flaw in the comment system into remote code execution by exploiting an administrator's active session. Because the entry point is an anonymous comment, an unauthenticated attacker may be able to compromise a vulnerable site once an admin views the malicious content. Site owners are advised to patch or apply mitigations promptly.

**Importance:** 3/5

## Sources

### Security
- [The Hacker News](https://thehackernews.com/2026/09/wordpress-comment2shell-flaw-can-turn.html) — Tue, 22 Sep 2026 11:33:14 +0530