The Brotli flaw we covered on October 30 is worse than a crash. Wordfence says its researchers reproduced unauthenticated remote code execution through WordPress in an isolated lab. That means an attacker with no login could run commands on the server.

Brotli is a compression library on your server. The flaw is CVE-2026-111497, scored 9.2 out of 10. It has circulated under names like HTTP2Shell, Node2Shell, and Brotli2Shell. Despite the first name, Wordfence says it does not involve the HTTP/2 protocol.

Why WordPress is exposed

This is not a bug in WordPress core, a plugin, or a theme. A specially crafted Brotli file can corrupt memory when your server unpacks it.

WordPress can be made to fetch data from other websites. A public proof of concept uses the pingback feature in xmlrpc.php, which needs no login, to make your server fetch and unpack a booby-trapped reply.

Wordfence says its lab test shows the attack can work. It also tested how well the public exploit carries over between closely related server setups. Results will vary by configuration, so do not assume your site is safe because your setup differs.

What to do

  • Ask your host to patch Brotli. Ask whether the Brotli library used by your site is fixed for CVE-2026-111497. Updating WordPress or a plugin will not change it.
  • Get the right versions. Fixed releases are 1.0.10, 1.1.1, and 1.2.1. Some Linux systems fix the bug without changing the version number, so ask your host to confirm.
  • Reduce exposure. If you do not use pingbacks, block xmlrpc.php at the web server or remove the pingback method.

Patching the server library is the only complete fix.

End of article