Unauthenticated XML-RPC Pingback Flaw Can Crash PHP Workers on Stock WordPress

En bref

• CVE-2026-111497 affects WordPress installations with xmlrpc.php reachable
• No login is needed; a crafted POST starts a pingback URL retrieval
• A Brotli-compressed response can crash PHP workers and cause denial of service
• Patchstack flagged the issue; stock WordPress deployments are in scope
• Disabling or filtering XML-RPC reduces exposure

A newly tracked WordPress vulnerability, CVE-2026-111497, describes a denial-of-service condition reachable through the XML-RPC endpoint. Patchstack called attention to the flaw, which affects default WordPress deployments where xmlrpc.php remains publicly accessible. The key risk is that no account or authentication is required to reach the vulnerable path.

The attack path begins with an unauthenticated HTTP POST to xmlrpc.php. That request causes the WordPress server to perform a pingback callback retrieval against a URL chosen by the sender. When the remote endpoint answers with a Brotli-compressed payload, the handling process can crash a PHP worker. Repeating the sequence can drain available workers and make the site unavailable to normal visitors.

This matters for K-12 and government web properties because many sites run standard WordPress configurations with XML-RPC enabled by default. A low-complexity availability attack can interrupt parent communications, staff workflows, and public information pages without any stolen credentials or data exfiltration. The immediate concern is uptime, not confidentiality.

XML-RPC has long been a target for pingback abuse and credential attacks, but this case adds a compression-related crash vector. Administrators should watch for repeated POSTs to xmlrpc.php, unusual outbound URL fetches, and PHP worker exhaustion. Vendor guidance, WAF coverage, and logging around XML-RPC traffic are the main things to track as response efforts develop.

À faire maintenant

1. Disable XML-RPC entirely at the web server or WAF if the site does not require it, blocking requests to xmlrpc.php.
2. If XML-RPC is required, restrict access to trusted source addresses and disable pingback methods that trigger outbound URL fetches.
3. Apply available WordPress, PHP, and vendor security updates tied to CVE-2026-111497, and test changes in staging first.
4. Add WAF or reverse-proxy rules to inspect POSTs to xmlrpc.php and block anomalous pingback or Brotli-compressed response patterns.
5. Monitor web and PHP logs for repeated xmlrpc.php POSTs, outbound callback attempts, and worker crashes; rate-limit suspicious clients.
6. Review PHP worker pool sizing and restart thresholds so a single crashing request does not take down the whole site.
7. After mitigation, verify that legitimate integrations still work and document the XML-RPC exposure decision.

Références CVE

• CVE-2026-111497

Source originale

Patchstack