Google Brotli · Public exploit code

Brotli flaw allows command execution via WordPress pingback

Nov 06, 2026 · 1 min read

Researchers demonstrated that a single unauthenticated request to WordPress xmlrpc.php triggers CVE-2026-111497 in the native Brotli decoder, which libcurl uses to process compressed HTTP responses, causing an out-of-bounds write (CWE-787). Google library versions 1.0.3 through 1.2.0 are vulnerable; in the lab, researchers achieved command execution on one specific build (WordPress 7.1.3, Debian 13.7, PHP 8.3.36), while the common effect is a PHP process crash. The source cites no fixed version; restrict access to xmlrpc.php and disable pingbacks until a patch exists.

By HIFY Radar newsroom Updated 11/06/2026 07:37 PM Get this every day →← Back to the feed 1 source

HighVulnerabilityPublic exploit codeFix unconfirmed

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Researchers demonstrated that a single unauthenticated request to a WordPress site can trigger a flaw in Google's Brotli compression library and crash the site or, under specific conditions, execute commands on the server. The flaw sits in the Brotli library used by libcurl; WordPress core does not contain it.

Why it matters

Any WordPress site with at least one post that accepts pingbacks is exposed to the attempt, with no password or account required. The most common effect is site downtime from a PHP process crash; command execution was achieved only in a lab and depends on memory layout and component versions.

What to do

Restrict or block access to xmlrpc.php and disable pingbacks, since the attack chain starts at that endpoint. Check whether your servers run Brotli versions 1.0.3 through 1.2.0 and await a library fix; the source cites no patched version.

For the technical team

CVE: CVE-2026-111497
Affected: Google Brotli (decodificador nativo usado pelo libcurl em respostas HTTP comprimidas), acionável via pingback do WordPress · Google Brotli library, versions 1.0.3 through 1.2.0. Lab demonstration used WordPress 7.1.3, Debian 13.7 and PHP 8.3.36.
Exploitation: Proof of concept demonstrated by researchers and publicized on dbugs via @ptdbugs. Command execution achieved only under lab conditions, on one specific build, dependent on memory layout and all component versions; the source reports no in-the-wild exploitation.
Fix: Source mentions no fixed version, patch or official mitigation. The chain depends on pingback: blocking xmlrpc.php and disabling pingbacks stops the described vector.
Vector: Out-of-bounds write (CWE-787) in the native Brotli decoder, invoked by libcurl when an HTTP response carries the Content-Encoding: br header. Trigger: unauthenticated pingback request to xmlrpc.php with a URL pointing to the attacker's server; WordPress calls wp_safe_remote_get, libcurl fetches the URL and receives the crafted Brotli stream. Condition: the site needs at least one post that accepts pingbacks.
More details: The payload is not sent in the request to WordPress; it arrives in the HTTP response from the attacker's server. The general effect of the chain is a PHP process crash (denial of service). The flaw sits in Google's Brotli library; WordPress core does not contain it.