HTTP2Shell is real: I turned one WordPress pingback into a Bash shell
Source Reddit ExploitDev
Discussion
A security researcher demonstrated a remote code execution (RCE) exploit chain against a specific WordPress Docker image dated 21 October 2026. The exploit leverages the WordPress pingback.ping XML-RPC method to achieve unauthenticated Bash shell access. This proof-of-concept targets one exact vulnerable Docker image digest and does not affect the latest official WordPress builds or WordPress core itself.
r/hacking (opens in a new tab)u/Z33S0 points0 comments
I reproduced a full unauthenticated RCE chain against a pinned, 21 October Docker Official Image for WordPress, triggered through /xmlrpc.php.
The chain fires from a single inbound pingback.ping call, which triggers two outbound fetches within the same PHP request. It works with ASLR enabled, needs no memory leak, and requires no cross-request heap grooming.
Note: this PoC targets one exact vulnerable image digest, it does not work against current wordpress:latest builds or WordPress core itself.
Repo: https://github.com/caveeroo/cve-2026-111497-wordpress-poc