Security · IHS Blog
Is WordPress affected by PHP2Shell? Why updating WordPress alone doesn't fix it
Since October 21, 2026, headlines about PHP2Shell have sent a lot of WordPress owners to their dashboards looking for an update button. There isn't one, and that's the confusing part.
Where the bug lives
WordPress is software written in PHP. PHP itself runs on your web server, installed and managed by your host. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a flaw in PHP, so it affects any website served by an unpatched PHP install: WordPress, Joomla, Drupal, WooCommerce, or a custom PHP app.
Who fixes it
- Shared and managed hosting: your host updates PHP, sometimes automatically and sometimes only when you choose a version in their panel.
- Your own server or VPS: you or your developer update PHP packages.
- Fully hosted platforms: the platform manages PHP; check their announcements.
The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything from PHP 5.4 through 8.5.11 below those on its branch is affected, according to Google Cloud.
What updating WordPress does and doesn't do
Updating WordPress core, your theme and your plugins closes WordPress-level holes, and this month had several (see our October roundup). It does not change the PHP version underneath. You need both.
The quick check
Follow our 5-minute PHP version guide, then read the full PHP2Shell guide for the timeline and current exploitation status.
Questions
Do I need to update my plugins for PHP2Shell?
Plugin updates do not fix PHP2Shell. The fix is a PHP update on the server. Keep plugins updated for their own security issues.
Is WordPress.com affected?
Hosted platforms manage PHP for you. Check your provider's status page or announcements rather than assuming either way.
Want off WordPress? We convert WordPress sites to fast, secure static HTML on our platform for free, and keep your URLs and Google rankings intact.