{"uuid": "55c26fa2-3209-4151-bdd2-f4c01349b0bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93485", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/10118", "content": "\u203c\ufe0f WordPress \"Comment2Shell\" vulnerability (CVE-2026-93485) can turn an anonymous comment into server code execution through a logged-in admin session.\n\nThe chain starts as stored XSS, fires when the page loads, and can use the admin\u2019s session to upload a web shell.\n\nDetails \u2192 https://thehackernews.com/2026/09/wordpress-comment2shell-flaw-can-turn.html", "creation_timestamp": "2026-09-22T09:00:04.503649Z"}