Security researcher Kursat Cetin of Patchstack described on October 30, 2026 how attackers can use the vulnerability CVE-2026-111497 to crash the PHP processes of a default WordPress installation. The flaw lies in Brotli, a Google library for decompressing compressed data, and affects versions 1.0.3 through 1.2.0. WordPress does not ship Brotli itself. For every request to the network, however, WordPress uses the server's cURL and therefore its Brotli build.
Google rates the vulnerability as critical, with 9.2 out of a possible 10 points. The US cybersecurity agency CISA added CVE-2026-111497 to its catalog of actively exploited vulnerabilities on October 27.
How does the attack reach your WordPress site?
The simplest route is the pingback feature. An attacker sends a pingback to the file xmlrpc.php without an account and specifies an address on their own server as the source. WordPress fetches this address, the attacker's server responds with manipulated Brotli data, and as soon as it is decompressed, Brotli writes beyond the end of its memory area. A freshly installed WordPress meets all the prerequisites: XML-RPC is on, pingbacks are allowed, and at least one post accepts pingbacks.
How the attack works via pingbacks
The route without login, described by Patchstack on October 30, 2026
- Pingback to xmlrpc.php
- WordPress fetches the attacker's address
- Response with manipulated Brotli data
- cURL decompresses with Brotli
- PHP process crashes
So far, only the crash has been publicly demonstrated, not injected code.
Source: Patchstack
So far, the crash has been proven. A test attack published on October 27 crashed a PHP process with a single request or left it permanently running at full processor load with fewer than 100 bytes of data. According to Patchstack's assessment, a few hundred such requests are enough to take a site down permanently. So far, nobody has publicly demonstrated injected code via WordPress.
Pingbacks are not the only route. Any plug-in that fetches an address entered by a visitor on the server relies on the same library, for example for link previews or importing images. A firewall placed in front finds nothing suspicious in the request itself, because the malicious data only arrives with the response from the attacker's server.
Why doesn't a WordPress update help?
The flaw is fixed only in Brotli itself. On October 21, Google released versions 1.0.10, 1.1.1 and 1.2.1; on Debian and Ubuntu, the package is called libbrotli1. Both distributions have backported the fix into their older packages without changing Brotli's version number. A patched Debian 13 therefore still reports Brotli 1.1.0. What matters is the package version 1.1.0-2+deb13u1; on Debian 12 the corrected version is 1.0.9-2+deb12u1, on Ubuntu 24.04 LTS 1.1.0-2ubuntu0.1.
According to Patchstack, the official Docker image wordpress:latest still contained the vulnerable library on October 30.
What this means for you
On an ordinary web hosting package, you don't update system libraries yourself. It's best to ask your host today whether libbrotli1 on your server already has the corrected version. If you run your own server, install your distribution's security updates and then restart PHP and the web server so that the running processes load the new library.
Whether your site accepts pingbacks is revealed by a test request from the Patchstack article: if xmlrpc.php responds with error 403 (access denied), 404 (not found) or without XML content, this route is closed. According to Patchstack, many plug-ins disable XML-RPC only via the code setting xmlrpc_enabled, and that, of all things, does not block pingbacks.
Until the update arrives, you can disable the two pingback commands of XML-RPC with a few lines of code in the functions.php or block xmlrpc.php at the web server. If you use Jetpack, better choose the code solution, because Jetpack needs xmlrpc.php for the connection to WordPress.com. Another code snippet from Patchstack disables automatic decompression in WordPress and thus also closes the routes via plug-ins and feeds. Before any change to this file, it's best to create a backup; how to do that is shown in the lesson on security and backups in the WordPress beginner course.
Patchstack published the analysis on October 30, 2026.
Sources
