Brotli vulnerability enables unauthenticated remote code execution on WordPress sites
Original title: HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites
CVE-2026-111497 corrupts memory in Brotli library used by WordPress for outbound responses; public proof-of-concept works against PHP 8.3.36.
Google released CVE-2026-111497, a critical out-of-bounds write in Brotli that can lead to unauthenticated remote code execution if a specially crafted stream reaches a vulnerable decoder. The flaw is not in WordPress itself but in the separate Brotli library that WordPress may invoke for compressed responses from other servers. A public proof-of-concept exploits WordPress XML-RPC pingback. Lab testing confirmed code execution in the designed PHP 8.3.36 environment before patching; the same payload crashed PHP in one unpatched configuration. CISA lists the CVE as known exploited but provides no WordPress-specific details.
- Brotli library must be patched by hosting provider.
- Public PoC depends on server configuration.
- No confirmed production WordPress compromises.
- Updating WordPress does not fix the library.
Impact: Unauthenticated remote code execution
- 1.Ask hosting provider to patch Brotli library.
- 2.Test for CVE-2026-111497 in server environment.
- CVEs
- CVE-2026-111497
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
13 min read at wordfence.com
On October 22, 2026, Google published CVE-2026-111497, a critical vulnerability in Brotli, one day after the Brotli project released fixed versions. The vulnerability has circulated under several unofficial names, including HTTP2Shell, Node2Shell, and Brotli2Shell. The post HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites appeared first on Wordfence.
By Alex Thomas · wordfence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.