---
id: 10401
title: "CVE-2026-111497: Unauthenticated WordPress RCE Exploit Chain PoC via Brotli Decoder Flaw"
cve: CVE-2026-111497
cvss: 9.2
severity: critical
vendor: "Google"
product: "Brotli"
affected_versions: "1.0.3 - 1.2.0"
source_domain: github.com
source_url: "https://github.com/caveeroo/cve-2026-111497-wordpress-poc"
published_at: "2026-10-28T22:42:33Z"
tags: ["rce", "wordpress", "red-team", "brotli"]
phying_url: "https://phying.com/item/10401"
lang: en
---

# CVE-2026-111497: Unauthenticated WordPress RCE Exploit Chain PoC via Brotli Decoder Flaw

## Summary

A source-only proof-of-concept demonstrating unauthenticated remote code execution against a pinned Docker Official Image for WordPress. The exploit chains WordPress's XML-RPC pingback.ping outbound fetch with a heap out-of-bounds write in Google Brotli (CVE-2026-111497). The malformed Brotli stream corrupts PHP's strtolower handler pointer to system without needing an address leak to bypass ASLR mode 2, executing arbitrary Bash commands on retry.

## Why it matters

Demonstrates a reliable, real-world weaponization of the Brotli decoder memory corruption flaw in web application environments without requiring information leaks or debugging instrumentation. Highlights the critical risk of untrusted compressed streams in server-side HTTP clients.

## Intelligence Metadata

- **Sources:** github.com
- **CVE:** CVE-2026-111497
- **CVSS:** 9.2
- **Vendor:** Google
- **Product:** Brotli
- **Affected versions:** 1.0.3 - 1.2.0
- **Published:** 2026-10-28T22:42:33Z
- **Original:** https://github.com/caveeroo/cve-2026-111497-wordpress-poc
- **Phying News:** https://phying.com/item/10401