WordPress CVE-2026-119977 and Brotli CVE-2026-111497: Two Exploited Flaws, What to Do Now

CVE-2026-119977 lets an attacker with no login run code on a WordPress server while a core upgrade is in progress. CISA confirmed attacks in the wild on 3 November 2026. Update every site to 7.1.4, or the latest release on its branch, then check sites that upgraded recently for signs of compromise.

A second exploited flaw, CVE-2026-111497 in the Brotli library, reaches WordPress through its HTTP requests, so update the server's Brotli and cURL packages too.

• 8.1 - CVSS 3.1 score from Wordfence, rated high
• 0 - logins an attacker needs
• 4.7 - oldest affected version; fixes were backported to every branch since
• 3 Nov - CISA added it to the exploited vulnerabilities list

WordPress runs a large share of company websites, from marketing sites to member portals and shops. On 28 October 2026 WordPress 7.1.4 fixed a flaw in the core upgrade process, tracked as CVE-2026-119977. Within a week the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog, which it does only when it has evidence of real attacks.

This guide explains what the flaw means for a business, which sites are exposed and what to do this week.

What the flaw is, in plain English

When WordPress installs a full new version of itself, it unpacks the new files into a temporary staging folder before moving them into place. In affected versions that folder has a predictable name and can be reached from the web.

For a short time, an attacker who wins the race can request files there and get the server to run their code. No account is needed. The time window is short, which is why Wordfence rates the attack complexity as high. But WordPress sites upgrade automatically and on a predictable schedule, so attackers can try many sites at once and wait for an upgrade to start.

Who is exposed

• Site on 4.7 to 7.1.3 without its branch security release: Vulnerable during every full core upgrade
• Site upgraded to 7.1.4 or a branch fix (for example 7.0.8, 6.9.11, 6.8.12): Fixed for future upgrades; check for compromise if it upgraded while attacks were active
• Site older than 4.7: Outside the listed range but receives no security fixes at all; plan a move
• Managed WordPress host that controls core updates: Ask the host to confirm the version and whether staging paths are protected

Agencies and companies that run many WordPress sites are the most exposed, because a single forgotten staging or campaign site is enough for an attacker to get a foothold.

What to do this week

• List every WordPress site you own or run for clients, including staging, microsites and old campaign sites.
• Update each one to 7.1.4, or to the latest security release on its branch if you cannot move to 7.1 yet. Sites that allow automatic background updates should already be updating.
• Ask your host, or your operations team, to update the server's Brotli and cURL libraries and restart PHP (see below).
• Confirm the installed version in each dashboard, rather than assuming the automatic update worked.
• Check sites that upgraded recently for unexpected PHP files in the upgrade folder (normally wp-content/upgrade) or the web root, new administrator accounts and unfamiliar scheduled tasks.
• If you find signs of compromise, take the site offline or restore a clean backup, then rotate database, hosting and API passwords.

To check the PHP version and settings underneath WordPress at the same time, run the free php-security-check tool on the server. It reports outdated WordPress installs and common configuration mistakes.

Also patch: the Brotli flaw (CVE-2026-111497)

A second exploited flaw affects WordPress servers from underneath. CVE-2026-111497 is a memory corruption bug in the Brotli decompression library, versions 1.0.3 to 1.2.0, rated CVSS v4 9.2. CISA added it to its exploited vulnerabilities list on 27 October 2026.

The PHP team says PHP reaches the vulnerable code through the cURL extension when automatic response decompression is on. WordPress's HTTP API, built on the Requests library, turns it on for every outbound request.

So a WordPress site whose server has an unpatched Brotli library can be attacked by any server it fetches from: update checks, plugin API calls, oEmbed previews, feed imports and webhooks. The WordPress 7.1.4 update does not fix this, because the flaw is in the server's libraries.

• On Linux, apply operating system security updates for Brotli and cURL, then restart PHP-FPM or Apache.
• On Windows, install the PHP builds 8.5.12-1, 8.4.27-1, 8.3.36-1 or 8.2.35-1 from php.net.
• On managed hosting, ask the host to confirm the server's Brotli library is 1.2.1, 1.1.1 or 1.0.10 or later.
• Rebuild Docker images, since a running container keeps its old library.

Why this keeps happening

Flaws in the update mechanism are especially awkward, because the normal advice to update quickly is also the moment of risk. Teams that cope well have an up-to-date inventory of their sites, a routine for confirming versions after each release, and logging that would show a suspicious file.

If every advisory turns into a scramble, an application security review finds what else is exposed and sets up that routine. Older sites that cannot be updated safely are a case for legacy application modernization. Other current issues are listed on our PHP security advisories page.

Are we covered?

• Do we have a complete list of our WordPress sites, including staging and old campaign sites?
• Is every site on 7.1.4 or the latest security release on its branch, and who checked?
• Have our servers' Brotli libraries been updated and PHP restarted?
• Have sites that upgraded since late October been checked for unexpected files and accounts?
• Which sites run versions too old to receive security fixes, and what is the plan for them?

Application security

Need help checking your WordPress sites? We can inventory your sites, apply the fix safely and look for signs that the flaw was used against you.

Sources

• NVD: CVE-2026-119977
• WordPress 7.1.4 security release
• Wordfence: WordPress core upgrade-window remote code execution
• CISA Known Exploited Vulnerabilities catalog
• PHP: updated Windows builds for Brotli security fix
• NVD: CVE-2026-111497 (Brotli)
• WordPress Requests cURL transport source

Originally published at phpscientist.com.