PHP2Shell and WordPress: Is Your Site Affected?
PHP2Shell affects WordPress sites through the PHP version they run on, not through WordPress code. A fully updated WordPress site on an unpatched PHP build is still vulnerable.
Why WordPress sites are exposed to PHP2Shell
The researchers behind PHP2Shell demonstrated unauthenticated remote code execution against the latest WordPress container image. WordPress was a showcase target because it is the largest PHP application. The flaw is in PHP's memory and error handling, which every request touches. No WordPress account is needed.
Check your WordPress PHP version
- Log in to wp-admin and open Tools → Site Health → Info → Server.
- Read PHP version, for example 8.2.29.
- Enter it in the PHP2Shell checker, or compare it with the table below.
| PHP branch | Vulnerable | First fixed release |
|---|---|---|
| 8.5 | < 8.5.12 | 8.5.12 |
| 8.4 | < 8.4.27 | 8.4.27 |
| 8.3 | < 8.3.36 | 8.3.36 |
| 8.2 | < 8.2.35 | 8.2.35 |
| 8.1, 8.0, 7.4 and older | All releases | No new official release. Use a vendor package with the fix backported, or move to a fixed branch. |
How to fix PHP2Shell on WordPress hosting
Shared or managed hosting
Open your hosting panel's PHP version selector (cPanel "MultiPHP Manager" or "Select PHP Version", Plesk "PHP Settings", or your host's own dashboard) and pick a fixed version. If it only shows the branch, contact support and ask: "Does your PHP build include the fixes for CVE-2026-109618 and CVE-2026-109619?"
Your own VPS or server
Update PHP with your package manager and restart Apache or PHP-FPM. Commands for each platform are in the PHP2Shell patch guide.
Docker
Rebuild from a fixed wordpress or php image tag and recreate the container. An old running container stays vulnerable.
While you wait for your host
Turn on your CDN's managed rules. Cloudflare says its PHP2Shell rules are live on all plans, including Free. Then apply the safe php.ini changes from the mitigation page, such as display_errors = 0 and session.upload_progress.enabled = 0. Treat these as stopgaps until PHP is updated.
After patching: clean-up checklist for WordPress
- Confirm the new PHP version in Site Health, and check every site on the same server or account.
- Look for admin users, plugins or files you did not add, especially PHP files in
wp-content/uploads. - Review server logs for repeated HTTP 500 errors or PHP worker crashes before the update, and for unusually large
PHPSESSIDcookies. - Rotate the database password, API keys stored in plugins and the authentication salts in
wp-config.php. That logs everyone out, which is the point. - Keep backups from before and after the update, so you can compare them if something looks off later.
PHP2Shell WordPress FAQ
Does updating WordPress fix PHP2Shell?
No. WordPress, themes and plugins run on top of PHP. The vulnerable code is in the PHP runtime, so only a PHP update fixes it.
Is there a WordPress plugin that blocks PHP2Shell?
A plugin runs inside PHP, after the vulnerable code paths. On Apache with mod_php the attack can fire before any application code runs, so a plugin cannot be relied on. Use a PHP update, and a WAF rule only as a stopgap.
Is WordPress.com affected?
Automattic says sites on WordPress.com, WordPress VIP, WP Cloud, Pressable and Tumblr are protected and customers need to take no action. Self-hosted WordPress depends on your own server or host.
Should I change my passwords?
If your site ran a vulnerable PHP version while exposed, memory disclosure could have leaked secrets. Rotating admin passwords, database credentials, API keys and the salts in wp-config.php is a sensible precaution.