WordPress doesn’t ship Brotli. It’s still exposed to CVE-2026-111497

Although WordPress doesn't bundle Brotli itself, researchers show that an unauthenticated request can still trigger the dangerous decoder bug tracked as CVE-2026-111497, which carries a CVSS score of 9.2. The issue lives in Google's Brotli library (versions 1.0.3 through 1.2.0) and is reachable because WordPress's HTTP layer relies on the system's libcurl, which automatically decompresses any response — including malicious Brotli-encoded replies. An attacker can abuse the built-in pingback.ping XML-RPC method to make a site fetch a URL under their control; the attacker's server then returns a corrupted Brotli stream that triggers an out-of-bounds write, crashing or hanging the PHP worker that processes it. Beyond XML-RPC, any plugin or theme that fetches user-supplied URLs server-side (link previews, oEmbed, feed readers, webhook handlers) is exposed the same way, and a web application firewall cannot catch the attack since the malicious payload arrives in the outbound response, not the inbound request. CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities list on 27 October 2026, and the real fix is upgrading the underlying Brotli package to 1.0.10, 1.1.1, or 1.2.1 — site owners can also disable pingback, block xmlrpc.php, or force libcurl to skip auto-decompression as temporary mitigations.