Critical Brotli Flaw Enables RCE Through WordPress XML-RPC in Lab Tests

Wordfence reproduced unauthenticated remote code execution through WordPress’s XML-RPC pingback feature by exploiting CVE-2026-111497, a critical out-of-bounds write in the Brotli decoder dubbed HTTP2Shell. Rated CVSS v4.0 9.2, the flaw affects processes that decode attacker-controlled Brotli-compressed data; it is not a vulnerability in WordPress Core, plugins, or themes. A Fortbridge report linked on Reddit initially claimed execution through an anonymous pingback against a pinned WordPress image. Wordfence’s testing demonstrated substantial configuration dependence: the public exploit executed in its intended PHP 8.3.36 environment but failed against PHP 8.3.35, sometimes crashing a vulnerable worker instead.

CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, and security researchers observed exploitation attempts. However, Wordfence reported no independently reviewable public evidence of successful production compromise or exploitation through WordPress as of November 2, 2026. Administrators should urgently install vendor-patched Brotli packages or container images, verify all relevant library copies, and restart or redeploy every affected service. Updating WordPress or restricting XML-RPC may reduce exposure through one route but does not repair the underlying decoder vulnerability.