WordPress · PHP2Shell

Is my WordPress site affected by PHP2Shell?

Probably, unless your host has already patched PHP. WordPress was one of the public demo targets, but the bug is in PHP — so what matters is your server’s PHP version, not your WordPress version or plugins.

Last reviewed 2026-10-22

Updating WordPress does not fix this

PHP2Shell is in PHP itself, below WordPress. Researchers demonstrated unauthenticated remote code execution against the official wordpress:latest image. What matters is the PHP version your server runs, and only whoever manages the server can update it.

1. Find your PHP version in WordPress

This shows the PHP that actually serves your site, which is the one that matters.

Log in to wp-admin and open Tools → Site Health.
Switch to the Info tab and expand Server.
Read PHP version (e.g. “8.3.6 (Supports 64bit values)”).
No admin access? Many hosting dashboards show the PHP version per site.

command line (shows the CLI PHP — may differ from the web server)

wp eval 'echo PHP_VERSION, PHP_EOL;'   # WP-CLI
php -v

2. Compare it

Check a PHP version

Paste a version, the output of php -v, or one version per line for a whole fleet. Runs entirely in your browser.

Try:

The CLI and the web server can run different PHP builds. Check the version your web server actually uses: php-fpm -v (or php-fpm8.3 -v), or phpinfo() served by that site.

Branch	Vulnerable	Fixed in
8.5	< 8.5.12	8.5.12
8.4	< 8.4.27	8.4.27
8.3	< 8.3.36	8.3.36
8.2	< 8.2.35	8.2.35
8.1 · 8.0 · 7.4	all	Source backport only
5.4 – 7.3	all	No fix

3. Get it patched

Shared or managed hosting

Your host patches PHP. Choose the newest PHP version in your hosting panel, then ask them to confirm the patch and the restart. Hosting guide →

Your own server, VPS or container

You (or your developer) patch PHP and restart PHP-FPM / Apache. Patch guide →

email to your host

Subject: PHP2Shell (CVE-2026-109618 / CVE-2026-109619) — patch status

Hi,

Please confirm that the PHP runtime serving my site(s) <domain> has been
updated to a release that fixes CVE-2026-109618 and CVE-2026-109619
(PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or a vendor build with the backport),
and that PHP-FPM / LSAPI workers were restarted afterwards.

If my account is on PHP 8.1 or older, please tell me which patched version
I can move to.

Thanks

Managed WordPress hosting

Managed WordPress hosts (for example WP Engine, Kinsta, WordPress.com / Pressable, SiteGround) run PHP for you, and most patch at platform level without action on your side. Automattic was among the industry partners that helped prepare guidance before disclosure.

We have not verified each host’s patch status. Check your host’s status page or support announcements, or send them the message above.

Plugins and themes

No plugin causes or fixes PHP2Shell. Deactivating plugins, switching themes or hardening wp-config.php does not change your exposure. A security plugin runs after PHP has parsed the request, which is already too late.

4. After patching

Check the PHP version in WordPress again — it should show a fixed release (or ask your host to confirm a backported build).
If the site was exposed for a while, change admin passwords and API keys stored in the site configuration, and look for unknown admin users or new PHP files. Detection guide →

Questions

Is my WordPress site affected by PHP2Shell?+

If it runs on PHP older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (and the host has not installed a patched package), yes. The WordPress version, theme and extensions do not matter — the bug is in PHP.

Will updating WordPress fix PHP2Shell?+

No. WordPress updates change the application, not the PHP runtime underneath. Keep WordPress updated anyway, but the fix is a PHP update by whoever runs your server.

Does an attacker need an admin account?+

No. The demonstrated attacks are pre-authentication: no login, no special plugin or module, just HTTP requests to the site.

Do WordPress automatic updates install the PHP fix?+

No. WordPress core and plugin auto-updates never touch the PHP runtime. PHP is updated by your host or server administrator.

Does a security plugin like Wordfence protect me?+

Security plugins run inside WordPress, after PHP has already parsed the request — too late for this bug. They cannot stop PHP2Shell. A WAF in front of the site (e.g. Cloudflare) helps more, but the fix is still a PHP update.

I run WooCommerce. Is it worse?+

The risk is the same, but the stakes are higher: memory disclosure can expose customer sessions, admin cookies and payment-gateway API keys held in PHP memory. Rotate gateway keys if you suspect exposure.

Related