HTTP2Shell: critical Brotli flaw reachable through WordPress
CVE-2026-111497 (CVSS 9.2, listed by CISA as known exploited) is in the Brotli compression library, not in WordPress, a plugin or a theme. Wordfence reproduced unauthenticated remote code execution in a lab through WordPress's XML-RPC pingbacks, which make the server fetch and decode a crafted response. Updating WordPress, plugins or themes does not fix it.
Ask the host whether the Brotli decoder serving the site is patched for CVE-2026-111497 and the services were restarted after the update (on a VPS, update the system packages, then restart). Blocking unauthenticated XML-RPC pingbacks removes only the route shown in the public exploit and may break integrations; the xmlrpc_enabled filter and the Settings > Discussion option do not block them.
Core Security Initiative: security releases now come often
Security reports to WordPress jumped from 20 to 30 a month to hundreds a month (more than 3,000 this year), much of it AI-assisted research. Core shipped four security releases in 41 days (7.1.1 on September 17, 7.1.2 on September 22, 7.1.3 on October 6, 7.1.4 on October 28), closing more than 50 critical or high vulnerabilities, each fix backported to every branch still receiving security updates, down to 4.7.
Keep automatic minor (security) updates on, and expect more security releases: apply each one quickly rather than batching updates.
Fixes a weakness in the upgrade process that can lead to remote code execution during the upgrade window, several stored XSS issues (block markup, Interactivity API, Customizer selective refresh, Categories, Playlist, image and comments pagination blocks), leaking of unpublished Customizer changesets, and Notes readable by users who cannot edit the post. Root certificates were updated after the eMudhra revocation.
Update to WordPress 7.1.4 now; fixes are being backported to older branches down to 4.7.
Seven security fixes, including a stored XSS on the Comments admin page, a DoS in WP_Http::make_absolute_url(), a second-order SQL injection in WXR export, Author users able to sticky posts, unauthenticated disclosure of comments on private posts, and forgeable parameters to the {status}_{type} hook.
Update to WordPress 7.1.3 or later (7.1.4 is current).
An unauthenticated attacker could, under certain conditions, make page template resolution include a readable local PHP file outside the active theme, which can lead to remote code execution (CVE-2026-87902).
Fixes include stored XSS in wpautop(), an HTML API set_modifiable_text() comment breakout, authenticated path traversal in the REST Templates controller, Contributor+ arbitrary post overwrite, and comments (including notes) that any logged-in user could reparent.
Authenticated Author+ users could achieve remote code execution through a malicious file upload on sites using Imagick and Ghostscript (CVE-2026-65640).
Update to the latest 7.0.x or 7.1.x release, especially on servers with Imagick and Ghostscript.
WordPress 7.0.2 fixes critical SQL injection and RCE
Fixes a facilitated SQL injection and a REST API batch-route confusion with SQL injection leading to remote code execution. Forced auto-updates were enabled. Fixed versions also include 6.9.5 and 6.8.6.
Make sure no site runs 7.0.0 or 7.0.1, or a 6.9/6.8 release older than 6.9.5/6.8.6.
