Barsec Cyber Intel
Your WordPress Website Can Be Vulnerable Even When WordPress Is Updated.
A security flaw in Brotli, a compression tool many web servers use behind the scenes, has been fixed. Your host should confirm their servers have the patched version.
What happened
Brotli is a tool that shrinks web pages so they load faster. It usually runs on the server that hosts your website, not inside WordPress itself. Google's Brotli project has released fixes for a flaw, CVE-2026-111497, that the project describes as an out-of-bounds write that can permit remote code execution. The fixes are in versions 1.0.10, 1.1.1 and 1.2.1, one for each supported branch.
Why this matters
Keeping WordPress and plugins updated is important, but it is not the whole picture. Your site also depends on software your hosting provider runs underneath it. This does not mean every WordPress website is vulnerable. Whether yours is exposed depends on how your host's servers are set up and which Brotli version they use.
What you should do
- You do not need to change anything inside WordPress for this one.
- Send your hosting provider a short note: "Can you confirm your servers use a patched Brotli version (1.0.10, 1.1.1 or 1.2.1 or later on the matching branch) for CVE-2026-111497?"
- If you manage your own server, ask your IT provider to update Brotli and any software bundling it, then restart the affected services.
- If your host does not respond or you are not sure who hosts your site, send Barsec a message and we can help find out.