Brotli vulnerability can enable WordPress code execution
The Brotli vulnerability tracked as CVE-2026-111497 can let an unauthenticated attacker execute code through WordPress when several server and site conditions align. Google published the vulnerability on October 22, 2026, one day after the Brotli project issued corrected releases. It has a CVSS v4.0 score of 9.2 out of 10, a standard severity rating that marks it as critical. The flaw is also informally called HTTP2Shell, Node2Shell and Brotli2Shell, although it does not involve the HTTP/2 protocol.
Brotli is a compression format and software library that reduces the size of web content during transfer. It is usually supplied by a hosting platform, operating system, container image, web server or another server component, so a WordPress owner may never see its name in the dashboard. The vulnerability is not in WordPress Core, a plugin or a theme. Updating those components will not replace the affected Brotli library.
CVE-2026-111497 is an out-of-bounds write, which means maliciously compressed data can make Brotli write beyond its assigned area of memory. That corruption may crash a process, reveal information held in memory or permit remote code execution, meaning an attacker runs commands without being physically present. However, merely finding Brotli on a server does not establish that a website is exploitable. Attacker-controlled compressed data must reach a vulnerable decoder through a website or another exposed service.
The first corrected upstream releases are Brotli 1.0.10 for versions 1.0.3 through 1.0.9, 1.1.1 for version 1.1.0, and 1.2.1 for version 1.2.0. Linux and hosting vendors may backport a correction, meaning they add the security repair to an older numbered package. Debian 13, for example, corrected the issue in libbrotli1 1.1.0-2+deb13u1 even though the package name still starts with 1.1.0. Administrators therefore need to compare the complete package revision with the vendor's security notice, rather than relying on the first three version numbers.
The public WordPress proof of concept uses XML-RPC, a WordPress interface through which other systems can call site functions. An unauthenticated request invokes pingback.ping at xmlrpc.php and supplies an attacker-controlled web address. WordPress retrieves that address to verify that it links to a genuine post. The attacker's server then responds with specially prepared data marked as Brotli-compressed. If the decoder, PHP build and memory arrangement match the payload, the attacker can execute code with the permissions assigned to the website's PHP process.
This route has several prerequisites. xmlrpc.php must be reachable, pingback.ping must be registered, the post must accept pings, the server must be permitted to make the outbound request, and the site's HTTP client, the software that retrieves web content, must use the affected decoder. The published exploit must also closely match the PHP build, runtime environment and memory layout. XML-RPC is only the trigger chosen by this demonstration, not an inherent requirement of the Brotli flaw. Other software could expose the same decoder, while plugins and themes could create additional WordPress routes.
Wordfence Threat Intelligence reproduced unauthenticated code execution in isolated containers, which are packaged software environments, using WordPress 7.1.3 on Debian 13.7, Apache 2.4.69, PHP 8.3.36 running inside Apache as mod_php, and the vulnerable Debian libbrotli1 1.1.0-2+b7 package. Standard operating-system memory randomization was enabled. After only Brotli was upgraded to Debian's corrected package, the same sequence did not execute code and the server remained healthy.
The identical payload did not execute code against PHP 8.3.35. In one vulnerable WordPress environment, it crashed the PHP worker instead. Wordfence says this demonstrates that the PHP version by itself does not determine the result. The exact build and runtime can decide whether a payload executes code, causes a crash or has no effect. Attackers may remotely identify WordPress, PHP, the web server, XML-RPC availability and some outbound-request behaviour, which could help them select payloads for commonly reused server images. Ordinary web requests do not normally disclose the exact compiled build or memory layout required to adapt this payload to any arbitrary server, and Wordfence did not demonstrate such remote adaptation.
Evidence of active targeting exists, but the publicly documented outcomes remain limited. The US Cybersecurity and Infrastructure Security Agency added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on October 27, 2026, without identifying the affected application, victim, route or outcome. ELLIO captured an attempt aimed at an official Node.js build, but it failed to produce command access in 50 replays against a matching vulnerable target. Previdian continued to see attempts through November 2, while noting that its telemetry could not show whether targets were vulnerable or attacks succeeded. Check Point reported automated scanning and suspicious payloads, but no confirmed compromise. Imperva and ELLIO separately achieved code execution against vulnerable Node.js builds in controlled laboratories.
Those tests show that exploitation is possible outside WordPress, but they do not document a production breach. As of November 2, 2026, Wordfence found no independently reviewable public report of a successful production compromise or a compromise through the WordPress XML-RPC route. CISA's limited public entry means that this absence is not evidence that exploitation has never succeeded.
A WordPress version shown under Tools and Site Health cannot answer whether the server is protected. Managed-hosting customers should ask whether every Brotli decoder used by their site contains the correction for CVE-2026-111497 and whether all affected services were restarted or redeployed. The unauthenticated XML-RPC system.listMethods function can show whether pingback.ping is registered, but that safe check proves only that the method exists, not that exploitation is possible. Disabling future pingbacks under Settings and Discussion may not change older posts, which can retain their previous settings.
Wordfence's Disable XML-RPC authentication option does not turn off unauthenticated pingbacks. WordPress's similarly named xmlrpc_enabled filter also applies only to methods requiring authentication and does not disable pingback.ping. Changing XML-RPC or pingback behaviour can break legitimate integrations and blocks only the demonstrated WordPress route. It does not repair Brotli.
Self-managed administrators should install their operating-system or platform update, verify the full package revision, and restart Apache, PHP-FPM, which runs PHP as a separate service, or any other process that loaded the old library.