HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites

On October 22, 2026, Google published CVE-2026-111497, a critical vulnerability in Brotli, one day after the Brotli project released fixed versions. The vulnerability has circulated under several unofficial names, including HTTP2Shell, Node2Shell, and Brotli2Shell. Despite the first name, the flaw does not involve the HTTP/2 protocol. It has a CVSS v4.0 score of 9.2 out of 10. A specially crafted Brotli stream can corrupt memory. If an attacker can make a vulnerable network-facing process decode it, the flaw can lead to unauthenticated remote code execution.

This is not a vulnerability in WordPress Core, a plugin, or a theme. However, WordPress can ask the server to retrieve data from other websites, and the server may use Brotli when it processes the response. A public proof of concept uses WordPress’s unauthenticated XML-RPC pingback feature to reach the vulnerable library.

The Wordfence Threat Intelligence team reproduced remote code execution in an isolated WordPress lab and tested how well the public exploit transferred between closely related server configurations. This article explains what we confirmed, what the test does and does not prove, and what WordPress site owners should do.

TL;DR

• Ask your hosting provider whether the Brotli library used by your site has been patched for CVE-2026-111497. Updating WordPress, a plugin, or a theme does not update this server-level library.
• Our lab testing confirmed unauthenticated remote code execution through WordPress. The public proof of concept repeatedly executed code in the PHP 8.3.36 server environment it was designed for. It did not execute after Brotli was patched.
• The current exploit depends on the server configuration. The same payload did not execute against PHP 8.3.35, although it crashed PHP in one vulnerable test environment. This shows that the public payload is not universal. Attackers may still be able to adapt it to commonly used server configurations, but we have not demonstrated remote adaptation to an arbitrary WordPress server.
• CISA lists CVE-2026-111497 as known exploited, but its public entry does not identify the affected application, attack route, or outcome. Sensor networks continue to record exploitation attempts, but the public reports we reviewed through November 2 do not document a successful production compromise or a compromise through WordPress.

What is Brotli, and what does it have to do with WordPress?

Brotli is a compression format and software library used to make web content smaller and faster to transfer. It is commonly supplied by the operating system, hosting platform, container image, web server, or another part of the software stack. Site owners may use it without ever seeing “Brotli” in the WordPress dashboard.

Brotli can be used for both incoming and outgoing web traffic. In the demonstrated WordPress attack, the dangerous data is not carried directly in the request sent to the site. Instead, WordPress makes an outbound request to an attacker-controlled server, and the vulnerable Brotli library processes the compressed response.