Stock WordPress pingback can crash workers via Brotli CVE-2026-111497
Original title: WordPress doesn’t ship Brotli. It’s still exposed to CVE-2026-111497
WordPress does not ship Brotli, but libcurl unpacks attacker-supplied br replies before WordPress sees them.
Patchstack says one unauthenticated pingback to xmlrpc.php can make a stock WordPress install fetch a Brotli body that crashes a PHP worker. CVE-2026-111497 is an out-of-bounds write in Google’s Brotli decoder, scored 9.2, covering 1.0.3 through 1.2.0 and fixed on October 21 in 1.0.10, 1.1.1, and 1.2.1. CISA added it to the KEV catalog on October 27, with a November 10 federal deadline. Public WordPress tooling stops at denial of service; the article says no public code-execution chain targets PHP.
Unconfirmed: No public chain shows remote code execution against PHP, Apache, or FPM; researchers say blind RCE is not established.
- A default install has XML-RPC on, open ping status, and at least one pingable post.
- The xmlrpc_enabled filter does not block unauthenticated pingback.ping.
- An October 27 lab killed a worker or pinned it at 100% CPU with a tiny payload.
- Other routes include remote requests, oEmbed, and SimplePie feed fetches.
- Setting decompress to false does not stop libcurl from unpacking the reply first.
Impact: Out-of-bounds write can crash workers; code execution is harder
| Product | Affected | Fixed in |
|---|---|---|
| Google Brotli | 1.0.3 through 1.2.0 | 1.0.10, 1.1.1 and 1.2.1 |
| WordPress | stock installs using system libcurl | — |
- 1.Update the operating system’s Brotli packages to 1.0.10, 1.1.1, or 1.2.1.
- 2.Block xmlrpc.php at the web server rather than relying on xmlrpc_enabled.
- 3.Confirm whether pingback.ping still runs before assuming XML-RPC is disabled.
- CVEs
- CVE-2026-111497
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
10 min read at patchstack.com
One unauthenticated POST to xmlrpc. php can take down a PHP worker on a stock WordPress install, and there is nothing unusual about the request that does it. The attacker sends a pingback whose source URL points at a server they own.
By Kursat Cetin · patchstack.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.