As cited
Copy frozen at (site build).
vulnerabilities
HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites
Google disclosed CVE-2026-111497, a critical vulnerability in Brotli compression library with a CVSS v4.0 score of 9.2, which allows unauthenticated remote code execution through specially crafted compressed streams. Wordfence confirmed code execution against WordPress sites via the XML-RPC pingback feature but found the public exploit is configuration-dependent and not universally transferable across different server environments. As of November 2, 2026, no independent public reports document successful production compromises, though CISA lists the vulnerability as known exploited and multiple organizations observe active exploitation attempts.
Why it matters: WordPress site owners must request that their hosting provider confirm Brotli has been patched for CVE-2026-111497 and that affected services were restarted, because updating WordPress does not update this server-level library and attacks are already occurring in the wild.
- Source published
- First seen by Cybersecurity Tracker