A flaw in Brotli, a compression library on your server, can let a single anonymous request crash part of your WordPress site. Patchstack explains that WordPress does not ship Brotli, so there is nothing to update inside WordPress or in a plugin.

The flaw is CVE-2026-111497, scored 9.2 out of 10. It affects Brotli 1.0.3 through 1.2.0. Google fixed it on October 21 in versions 1.0.10, 1.1.1, and 1.2.1. CISA added it to its list of known exploited flaws on October 27.

How the attack works

WordPress can accept “pingbacks,” which are notices that another site linked to yours. Sending one needs no login. The attacker points the pingback at a server they control.

WordPress then fetches that address. The attacker’s server replies with a booby-trapped Brotli file. Your server’s curl library unpacks it, and the bug makes it write past its memory buffer.

Because the bad data comes back in the reply, a firewall cannot see it in the incoming request.

How serious is it

Patchstack says a public demonstration on October 27 crashed a PHP worker or pinned it at 100% CPU. It did not run attacker code. Patchstack says no public attack on PHP setups running behind Apache or PHP-FPM that goes beyond a crash exists yet.

Other routes can reach the same bug. Plugins that fetch a visitor-supplied web address, such as link previews or importers, are one. Embeds and feed fetching are others.

What to do

  • Ask your host to patch Brotli. Ask for the libbrotli1 package at 1.0.10, 1.1.1, or 1.2.1 or later. Debian and Ubuntu often fix this without changing the version number, so ask your host to confirm the fix is installed.
  • Run your own server? Update the package with your system’s package manager. If you use the official WordPress Docker image, add an upgrade step, because Patchstack says the latest image still ships a vulnerable version.
  • Turn off pingbacks. Disabling XML-RPC with the common filter does not stop pingbacks. Patchstack says you must remove the pingback.ping method, or block xmlrpc.php at the web server.
  • Watch for signs. Look for repeated anonymous POST requests to xmlrpc.php and PHP processes that crash.

Patching Brotli is the only real fix. The other steps reduce your exposure until it is done.

End of article