Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

CVE-2026-111497 Enables WordPress RCE via Brotli XML-RPC

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

CVE-2026-111497 in Brotli allows RCE on WordPress via XML-RPC pingback; public PoC works on PHP 8.3.36 but no production compromises reported.

Google's Brotli library, invoked by WordPress for compressed outbound responses, contains an out-of-bounds write (CVE-2026-111497) that can lead to remote code execution. An unauthenticated pingback to xmlrpc.php triggers the flaw, as shown by a public proof-of-concept that executes code in PHP 8.3.36 environments. Sites remain exposed until hosting providers update the Brotli library, since WordPress core updates do not patch it. No production compromises are confirmed.

Key facts
  • CVE-2026-111497 fixed in Brotli 1.0.10, 1.1.1, 1.2.1 on 2026-10-21
  • Public PoC achieves RCE in PHP 8.3.36
  • Unauthenticated XML-RPC pingback triggers vulnerability on stock WordPress
  • CISA added CVE-2026-111497 to KEV on 2026-10-27
  • November 10 federal deadline for exploitation
  • WordPress updates do not fix underlying Brotli library
Analyze CVE-2026-111497 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 21, 2026Brotli fixed in versions 1.0.10, 1.1.1, 1.2.1 · Patchstack
  2. Oct 27, 2026CISA added CVE-2026-111497 to KEV catalog · Patchstack
  3. Oct 27, 2026Lab testing showed PHP worker crash with payload · Patchstack
  4. Nov 2, 2026Wordfence published HTTP2Shell analysis · Wordfence
  5. Nov 10, 2026Federal deadline for CVE-2026-111497 · Patchstack

What each outlet adds

beyond the shared facts
  • PatchstackXML-RPC pingback trigger and other vectors like oEmbed feeds
  • WordfencePublic PoC RCE confirmation and no production compromises
CVEs
CVE-2026-111497
Vendors
GoogleWordfence
Products
BrotliWordPresslibcurl
Organizations
CISA

Coverage

oldest first · one row per article · UTC
  1. · 3d ago PatchstackFirst report

    Stock WordPress pingback can crash workers via Brotli CVE-2026-111497

    WordPress does not ship Brotli, but libcurl unpacks attacker-supplied br replies before WordPress sees them.

  2. · 8h ago Wordfence

    Brotli vulnerability enables unauthenticated remote code execution on WordPress sites

    CVE-2026-111497 corrupts memory in Brotli library used by WordPress for outbound responses; public proof-of-concept works against PHP 8.3.36.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-111497
Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
9.283%KEVPoC ×25
KEV