WordPress doesn’t ship Brotli. It’s still exposed to CVE-2026-111497 patchstack.com

A critical out-of-bounds write in Google's Brotli decoder (now on CISA's known exploited list) can be reached on a stock WordPress site through libcurl, with an unauthenticated pingback to xmlrpc.php being the easiest route. Worth reading because there is nothing to update in WordPress itself, and the post explains why a WAF can't see it and what to do about it.

Read it on Patchstack