What does the HTTP2Shell flaw mean for WordPress sites?

HTTP2Shell is the name that has stuck to CVE-2026-111497, a vulnerability in Brotli, Google's data compression library. The bug sits in the part that decompresses data and affects versions 1.0.3 to 1.2.0. The project shipped the fixes, 1.0.10, 1.1.1 and 1.2.1, on 21 October 2026, and on 27 October the US cybersecurity agency CISA added the flaw to its catalogue of vulnerabilities already used in attacks. WordPress itself contains no Brotli code, but the server your site runs on may well have the library, and WordPress uses it whenever it fetches data from another site.

Despite the name, the bug has nothing to do with the HTTP/2 protocol. Nor is it related to PHP2Shell, the two critical flaws in PHP itself from the same month, which we covered in a separate post. Below you will find where exactly the bug is, who has to fix it and what to ask your host.

What Brotli is and where the bug sits

Brotli is a compression format. When a visitor's browser says it understands Brotli, the server can send the page, the stylesheets and the scripts compressed with it, so they travel faster. Modules such as mod_brotli for Apache and ngx_brotli for nginx do this job. According to their documentation they only compress responses, which means they use the library's encoder.

The vulnerability runs the other way, in the decoder that unpacks data the program receives (the file c/dec/decode.c). A crafted Brotli stream makes the decoder write past the memory set aside for it (an out-of-bounds write). According to the CVE record, an attacker without an account can use this to corrupt the program's memory, read parts of it, crash it or potentially run their own code. Red Hat points out that an attack is only possible when the affected program decompresses Brotli data supplied by the attacker.

Google is the CVE authority for Brotli and scores the flaw 9.2 out of 10 on CVSS 4.0, "critical". Red Hat rates it "Important". The CVSS score guide explains what these numbers mean.

Why HTTP2Shell affects WordPress without any Brotli in it

WordPress does more than answer visitors. It also fetches data from other sites, for example when it embeds a video from a link (oEmbed), reads an RSS feed or verifies a pingback from another blog. For these requests it uses curl, the server's library for network requests. WordPress's code sets CURLOPT_ENCODING to an empty value. According to the curl documentation, that tells curl to accept every compression it knows, Brotli included, and curl decompresses the response itself.

For Brotli, curl relies on the system library. On Debian, for instance, the libcurl package depends on libbrotli1, and libbrotli1 holds both the encoder and the decoder. That is how WordPress reaches the vulnerable code without containing a single line of Brotli.

Patchstack describes the shortest route. The attacker sends a pingback.ping request to the site's xmlrpc.php with the address of a server they control. WordPress opens that address to verify the link, and the attacker's server answers with a crafted Brotli stream. oEmbed, RSS fetching and any plugin or theme that fetches an address supplied by a visitor reach the decoder the same way. A web application firewall (WAF) sees nothing suspicious in the incoming request, because the dangerous content arrives in the other server's reply.

Is the flaw already being exploited?

CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalogue on 27 October 2026 and gave US federal agencies until 10 November to fix it. Researchers have achieved code execution against specific builds of Node.js and Bun.

For WordPress the picture is calmer for now. According to Patchstack, as of 30 October there is no public attack that runs code through PHP behind Apache or PHP-FPM. A published lab shows that a pingback can crash a PHP worker, and that a very small stream can pin the CPU. Patchstack therefore sees the main risk for WordPress sites as crashes and downtime (denial of service). The bug does corrupt memory, though, and the CVE record does not rule out code execution, so do not put the fix off.

Is your site affected?

The vulnerability lives on the server. Updating WordPress, the theme or the plugins does not fix it, and there is nothing to find under Plugins > Installed Plugins. Any site whose server still has an old Brotli library that curl or other software uses for decompression is affected.

From the outside, all you can see is whether the server compresses with Brotli. Run the command below in a terminal on a Mac or Linux machine, or in cPanel's Terminal. It only reads the response headers. Replace primer.bg with your site's address.

# Your computer's terminal or cPanel > Terminal
# Read-only. Shows whether the response comes Brotli-compressed.
curl -s -o /dev/null -D - -H 'Accept-Encoding: br' \
  https://primer.bg/ | grep -i -E '^(content-encoding|server):'

A line reading content-encoding: br means the site answers with Brotli. It shows only that Brotli is switched on, not that the server is vulnerable, because compression uses the encoder and the bug is in the decoder. If the server line says cloudflare or another CDN, the response comes from that CDN and tells you nothing about your own server. If br is missing, that is no sign of safety either, since curl on the server can decompress Brotli even when the site does not compress with it. Only whoever runs the server can give you a reliable answer.

What to ask your host

Send these questions to your host, or to whoever looks after your server:

• Has the operating system's Brotli package (called libbrotli1 on Debian and Ubuntu) been updated to a version that fixes CVE-2026-111497?
• Were PHP-FPM, the web server and the other services that use the library restarted afterwards? Processes started before the update keep running with the old copy until they are restarted.
• Is the PHP brotli extension installed, and if so, has it been updated to version 0.21.1, which comes with Brotli 1.2.1?
• Is xmlrpc.php blocked for sites that do not use it?
• Have the logs shown any Apache or PHP-FPM crashes (segfaults) since 21 October?

Distributions often add the fix to the old version without changing its number. That is why the patched package on Debian 13 still starts with 1.1.0, and your host needs to check the full package version rather than the number the library reports.

What to do

1. Write to your host with the questions above and ask for a written answer that the package is updated and the services restarted. This is the only step that fixes the bug itself.
2. While you wait, close the pingback route. If the site does not use XML-RPC, ask your host to block xmlrpc.php at the server, or ask your developer to remove the pingback.ping and pingback.extensions.getPingbacks methods with the xmlrpc_methods filter. Check with your developer first that nothing on the site relies on XML-RPC.
3. If your store is headless and the storefront runs on Node.js, for example with Next.js, update Node.js to 22.23.4, 24.22.1 or 26.12.1 and restart the app. If Node.js uses the system Brotli library, as Ubuntu notes for its releases from 22.04 on, the system package needs updating too. If the site runs in Docker, update libbrotli1 in the image and rebuild it, because according to Patchstack the official wordpress:latest image still contained the vulnerable version as of 30 October.
4. If the site starts returning 502 or 503 errors for no obvious reason, tell your host straight away. Crashing PHP workers is exactly what the attempts against WordPress so far have shown.

What we do

Brotli is a system library rather than a plugin, so it is not part of the daily check of plugins, theme and WordPress in vulnerability (CVE) monitoring. When we look after the site's server as well, the server security updates in WordPress maintenance include system libraries such as Brotli, along with restarting the services that use them. On shared hosting the packages are updated by the host. If you would like us to review your server, write to us through the inquiry form.

Sources

• CVE.org, CVE-2026-111497
• GitHub Advisory Database, GHSA-9v8h-qqgm-4m35
• Google Brotli, release 1.2.1
• Google Brotli, release 1.1.1
• Google Brotli, release 1.0.10
• CISA, Known Exploited Vulnerabilities, CVE-2026-111497
• Patchstack, WordPress doesn't ship Brotli, it's still exposed to CVE-2026-111497
• Red Hat, CVE-2026-111497
• Ubuntu, CVE-2026-111497
• Debian LTS, DLA-4855-1, brotli
• Debian, the brotli source package in trixie
• Debian, the libcurl4t64 package in trixie
• Node.js, October 2026 security releases
• php-ext-brotli, releases
• Apache HTTP Server, mod_brotli
• ngx_brotli
• curl, CURLOPT_ACCEPT_ENCODING
• WordPress, the Requests library, Transport/Curl.php
• WordPress Developer Resources, xmlrpc_enabled
• WordPress Developer Resources, xmlrpc_methods