# HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites

Out-of-bounds write in Brotli decoder reachable via WordPress unauthenticated XML-RPC pingback.ping, letting a crafted Brotli response achieve RCE as the PHP process.

- Payout: Real-world hack
- Severity: critical
- Program: Brotli
- Analysis by: Alex Thomas
- Disclosed: 2026-11-02
- CVE: CVE-2026-111497
- Write-up quality: 7/10
- Original: https://www.wordfence.com/blog/2026/11/http2shell-wordpress-brotli/
- Library page: https://bugbountylibrary.com/r/blog%3Awordfence-com-blog-2026-11-http2shell-wordpress-brotli
- Tags: area:web domain:web impact:mass-exploit impact:rce kind:incident platform:research sev:critical tech:php tech:wordpress technique:chained vuln:memory-corruption vuln:rce

**Target:** Brotli decompression library in network-facing HTTP client (WordPress XML-RPC pingback)
**Root cause:** Out-of-bounds write in the Brotli decoder: a malicious compressed stream makes the decoder write past the memory reserved for it, corrupting heap/adjacent memory.
**Steps:**
1. Send unauthenticated request to `xmlrpc.php` calling `pingback.ping` with a source URL controlled by the attacker.
2. WordPress fetches that URL to verify it links to a real post on the site.
3. Attacker server returns a response marked as Brotli-compressed containing the crafted stream.
4. Vulnerable Brotli decoder processes it and corrupts memory; a payload matching the target's PHP build and memory layout executes code as the PHP process.
**How found:** Wordfence reviewed stock WordPress Core for unauthenticated routes that let an attacker supply a public URL for server-side fetching; pingback.ping was the clear candidate, other URL-fetching features required auth or prior content control. They then reproduced the public PoC in isolated containers matching its exact target environment and tested payload portability across PHP builds.
**Exploitation:** Preconditions: xmlrpc.php reachable, pingback.ping registered, target post accepts pings, server allowed outbound requests, and the HTTP client uses the vulnerable Brotli decoder. Attacker hosts a page returning a malicious Brotli stream; WordPress's outbound fetch decodes it, corrupting memory and executing code with the web server's PHP permissions. Public PoC only worked against its exact target build (PHP 8.3.36, Debian 13.7, Apache 2.4.69, libbrotli1 1.1.0-2+b7); against PHP 8.3.35 it crashed the worker instead.
**Escalation:** Same decoder reachable from other network-facing software (Node.js builds demonstrated in labs by Imperva and ELLIO), broadening the attack surface beyond WordPress.
**Insight:** Server-side URL fetchers (pingback, oEmbed, link previews) are a delivery path for decoder/parser bugs in libraries the app never directly exposes; when a memory-corruption CVE lands in a compression/parsing library, enumerate unauthenticated outbound-fetch features as the trigger rather than the vulnerable endpoint itself.

## Write-ups of the same bug (oldest first)
- 2026-10-23: [Python packages are also vulnerable to the Node2Shell Brotli flaw (CVE-2026-111497)](https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-python-packages-vulnerable-node2shell-brotli-cve-2026-111497) — Aikido Security
- 2026-10-29: [Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder](https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-node2shell-cve-2026-111497-nodejs-brotli-decoder) — Datadog Security Labs
- 2026-11-02: [HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites](https://bugbountylibrary.com/r/blog%3Awordfence-com-blog-2026-11-http2shell-wordpress-brotli) — Alex Thomas (this one)