Improper neutralization of input during web page generation

CVE-2026-93485 is an unauthenticated stored cross-site scripting flaw in WordPress core's wpautop() paragraph-formatting function, affecting every version from 4.7 through 7.1. An anonymous visitor submits a comment containing a <blockquote cite="..."> tag with embedded newlines. The payload passes wp_kses() sanitization cleanly — nothing looks dangerous. But when the comment renders, the newlines trigger a cascade of misparses across wpautop() and wptexturize() that manufacture a valid JavaScript event handler (onfocus/autofocus) from what was inert markup. The XSS fires whenever *anyone* — visitor or admin — views the page. Researcher Rafie Muhammad of Awesome Motive published a complete Comment2Shell proof-of-concept on September 21 showing that when the payload fires in an admin session, injected JS fetches the plugin-upload form, extracts the nonce, POSTs a malicious ZIP, and achieves full server-side RCE without the plugin ever being activated. Fixed in WordPress 7.1.1 (Sept 17, 2026), backported to every supported branch down to 4.7.36.

The vendor rates this HIGH 7.1, but that score was built on CVSS impact values of C:L/I:L/A:L — scoring only the XSS itself, not the demonstrated RCE chain. Once an admin views the poisoned page, the attacker obtains web-server-level code execution: confidentiality, integrity, and availability impact are all effectively HIGH. With ~59 million WordPress sites visible on the internet (Censys, June 2026), only 14% running the latest patch, comments enabled by default, and the approval gate documented as bypassable, the real-world exploitability far exceeds what the 7.1 label conveys. The vendor severity understates the risk for any internet-facing WordPress site running default comment settings.

1. Deploy WAF rules blocking the blockquote-newline pattern — Wordfence and Patchstack released detection rules on Sept 18. If you run a WAF (Cloudflare, Akamai, ModSecurity), add a rule to block comment submissions containing <blockquote with cite attributes containing \n or %0a. This is your fastest mitigation — deploy within the noisgate mitigation SLA of 30 days for HIGH, though given the public PoC, deploying within 72 hours is strongly recommended.
2. Disable comments on all posts and pages — Run wp option update default_comment_status closed via WP-CLI, or set Settings → Discussion → uncheck 'Allow people to submit comments on new posts' and bulk-close existing comments. This eliminates the attack vector entirely without patching. Apply fleet-wide immediately.
3. Set DISALLOW_FILE_MODS in wp-config.php — Add define('DISALLOW_FILE_MODS', true); to wp-config.php. This blocks the plugin-upload step of the Comment2Shell RCE chain, breaking the escalation from XSS to code execution even if the XSS fires. It does NOT fix the XSS itself.
4. Deploy Content Security Policy headers — Set Content-Security-Policy: script-src 'self' (or tighter) on all WordPress front-end responses. This blocks inline event handlers like the onfocus payload from executing, neutralizing the XSS. Test thoroughly — many WordPress themes and plugins rely on inline scripts and will break without 'unsafe-inline'.
5. Patch to WordPress 7.1.1 or the corresponding backport for your branch — This is the definitive fix. The patch is a one-line regex change in wpautop(). Apply within the noisgate remediation SLA of 180 days for HIGH. Given the public PoC and massive attack surface, prioritize patching within 30 days. Use wp core update via WP-CLI for fleet deployment.
6. Enable file integrity monitoring on wp-content/plugins/ — Deploy OSSEC, Wazara, Tripwire, or equivalent FIM to detect new PHP files in plugin directories. This does not prevent exploitation but catches the RCE payload landing and enables rapid incident response.

Run this script on each WordPress host as any user with read access to the WordPress installation directory. Usage: bash check_cve_2026_93485.sh /var/www/html (pass the WordPress root directory as the first argument). No root privileges required.

#!/usr/bin/env bash
# CVE-2026-93485 — WordPress Core Stored XSS in wpautop()
# Checks WordPress version against patched releases.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

WP_ROOT="${1:-/var/www/html}"
VERSION_FILE="$WP_ROOT/wp-includes/version.php"

if [[ ! -f "$VERSION_FILE" ]]; then
  echo "UNKNOWN — Cannot find $VERSION_FILE. Is this a WordPress installation?"
  exit 2
fi

# Extract the $wp_version variable from version.php
WP_VERSION=$(grep -oP "\\\$wp_version\\s*=\\s*'\\K[^']+" "$VERSION_FILE" 2>/dev/null)

if [[ -z "$WP_VERSION" ]]; then
  echo "UNKNOWN — Could not parse WordPress version from $VERSION_FILE"
  exit 2
fi

echo "Detected WordPress version: $WP_VERSION"

# Patched versions per branch (first patched release)
declare -A PATCHED_VERSIONS=(
  ["7.1"]=1  ["7.0"]=5  ["6.9"]=8  ["6.8"]=9  ["6.7"]=8
  ["6.6"]=8  ["6.5"]=11 ["6.4"]=11 ["6.3"]=11 ["6.2"]=12
  ["6.1"]=13 ["6.0"]=15 ["5.9"]=17 ["5.8"]=16 ["5.7"]=18
  ["5.6"]=20 ["5.5"]=21 ["5.4"]=22 ["5.3"]=24 ["5.2"]=27
  ["5.1"]=25 ["5.0"]=28 ["4.9"]=32 ["4.8"]=31 ["4.7"]=36
)

# Parse major.minor and patch from version string
if [[ "$WP_VERSION" =~ ^([0-9]+\.[0-9]+)\.([0-9]+)$ ]]; then
  BRANCH="${BASH_REMATCH[1]}"
  PATCH="${BASH_REMATCH[2]}"
elif [[ "$WP_VERSION" =~ ^([0-9]+\.[0-9]+)$ ]]; then
  BRANCH="${BASH_REMATCH[1]}"
  PATCH=0
else
  echo "UNKNOWN — Unrecognized version format: $WP_VERSION"
  exit 2
fi

# Check if branch is in affected range
MAJOR=$(echo "$BRANCH" | cut -d. -f1)
MINOR=$(echo "$BRANCH" | cut -d. -f2)

# Versions before 4.7 are EOL and not backported — assume vulnerable
if (( MAJOR < 4 )) || { (( MAJOR == 4 )) && (( MINOR < 7 )); }; then
  echo "VULNERABLE — WordPress $WP_VERSION is below 4.7 (EOL, no backport available)"
  exit 1
fi

# Versions 7.2+ are not affected
if (( MAJOR > 7 )) || { (( MAJOR == 7 )) && (( MINOR >= 2 )); }; then
  echo "PATCHED — WordPress $WP_VERSION is beyond the affected range"
  exit 0
fi

# Look up required patch level for this branch
if [[ -v PATCHED_VERSIONS[$BRANCH] ]]; then
  REQUIRED_PATCH=${PATCHED_VERSIONS[$BRANCH]}
  if (( PATCH >= REQUIRED_PATCH )); then
    echo "PATCHED — WordPress $WP_VERSION >= $BRANCH.$REQUIRED_PATCH"
    exit 0
  else
    echo "VULNERABLE — WordPress $WP_VERSION < $BRANCH.$REQUIRED_PATCH (needs $BRANCH.$REQUIRED_PATCH+)"
    exit 1
  fi
else
  echo "UNKNOWN — Branch $BRANCH not in known affected/patched list"
  exit 2
fi

1. WordPress 7.1.1 Security Release — Official
2. Comment2Shell: Pre-Auth XSS to RCE Research — Rafie Muhammad
3. Patchstack Advisory — WordPress 7.1.1
4. OffSeq Threat Radar — CVE-2026-93485
5. HOL Blog — WordPress 7.1.1 Unauth Comment XSS
6. SecurityOnline — WordPress Stored XSS PoC Disclosed
7. Censys — WordPress EOL PHP and Exposure Data
8. Tenable — CVE-2026-93485