WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session
WordPress fixed a comment flaw that could lead to server code execution if a logged-in administrator opened the page.
More info