Skip to content
PHP Version Checker
WordPress

Does PHP2Shell Affect WordPress? How to Check and Fix It

WordPress sites are affected by PHP2Shell only when the PHP installation underneath them is affected. The vulnerability is in the PHP runtime, not in WordPress core, a plugin, or a theme. This guide explains why a WordPress update cannot replace a PHP update and how to check the version that actually serves your site.

Last updated:

PHP runtime, not WordPressSite HealthWP-CLI
Check a websitePHP2Shell advisory

Based on the official php.net advisory. This page contains no exploitation instructions.

Free checker

Check a WordPress site's PHP version

Paste a public URL. The checker reads response headers and homepage markup, detects WordPress when the generator tag or WordPress paths are visible, and compares the exposed PHP version with the official fix.

Try an example:

Free · No sign-up · We never store the URLs you check

The responsibility boundary

Why updating WordPress does not fix PHP2Shell

PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities in the PHP runtime. PHP executes before WordPress loads, so a vulnerable worker can be attacked before any WordPress, plugin, or theme code runs. Updating WordPress, installing a security plugin, or putting a web application firewall in front of the site does not change the PHP binary. Those layers can help with application-level attacks, but they cannot patch a flaw in the runtime.

The fix is to install a fixed PHP release and restart every PHP worker. The official fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The full version table is on the PHP2Shell checker. WordPress's own minimum PHP requirement is not the same as a patched PHP2Shell release: the minimum only says which version WordPress can start on, not which version contains the fix.

WordPress core

Updating core fixes WordPress bugs. It does not replace the PHP binary.

Plugins and themes

A security plugin can block some requests. It cannot repair a PHP runtime flaw.

PHP runtime

The fixed PHP release is the only layer that closes PHP2Shell.

Method 1

Check the PHP version in WordPress Site Health

Site Health is the fastest check when you can log in to WordPress. Open Tools → Site Health, switch to the Info tab, and open Server. The PHP version is listed there, along with the web server and other environment details. Open Info → WordPress to see the WordPress version, which is a different number.

Site Health reports what the web server is actually running, so it is more useful for this problem than a php -v result from a terminal. If the version is below the fixed release for its branch, or if it is on PHP 8.1 or older, treat the site as needing an upgrade. If the host exposes a PHP selector, use it after testing on staging.

Site Health path

  1. Log in to the WordPress admin.
  2. Open Tools → Site Health.
  3. Switch to the Info tab.
  4. Open Server and read the PHP version.

Method 2

Check with WP-CLI

If you have WP-CLI, run wp --info. It prints the PHP binary, PHP version, WordPress version, and other environment details. This is useful for inventory and automation, but it reports the command-line environment. On many servers the command line and the web server use different PHP builds, so a patched CLI does not prove that the website is patched.

Use WP-CLI as a first signal, then confirm the web SAPI with Site Health, the hosting panel, or a temporary PHP file. The how-to-check guide covers the CLI-versus-web difference in more detail.

wp --info

Run the command as the same system user that owns the WordPress installation. If the command is unavailable, use Site Health or the hosting panel instead.

Managed and shared hosting

What to do on managed WordPress and shared hosting

On managed WordPress hosting, the host usually controls the PHP version. Open the site dashboard and look for a PHP version or tools section, or ask support whether the site has been moved to a fixed release. On shared hosting, use cPanel's Select PHP Version or MultiPHP Manager, or Plesk's PHP Settings, if the host allows per-account or per-domain PHP selection.

Applying a PHP update is only half of the job. PHP-FPM, Apache, or container workers must be restarted so they stop serving the old binary. On shared hosting you may not have that control, so ask the host to confirm both the update and the restart. The cPanel and Plesk guide includes an email template for that request.

WordPress Site Health

  • Log in to the WordPress admin.
  • Open Tools → Site Health.
  • Switch to the Info tab, then open Server.
  • Read the PHP version in the list.

This reports the web SAPI, which is the version that matters for PHP2Shell.

Site Health details

WP-CLI

  • Open a shell on the server.
  • Run wp --info.
  • Read the PHP binary and PHP version.

The CLI can use a different PHP build from the web server.

WP-CLI details

Hosting panel

  • cPanel: Select PHP Version or MultiPHP Manager.
  • Plesk: Websites & Domains → PHP Settings.
  • Check the PHP version assigned to the domain.

The panel selector is usually authoritative for the web server.

cPanel and Plesk guide

After the update

Verify the front end, not just the dashboard

After the host or panel reports a new version, verify the front end. Site Health is the simplest WordPress-native check. The checker on this page reads public headers and can confirm a patched version when the site exposes one. A temporary file containing <?php echo PHP_VERSION; ?> shows the web SAPI directly; delete it immediately after use.

Do not rely only on php -v. The CLI and web server may use different binaries, and a host can run several PHP versions for different domains or directories. If the front end still shows the old version, the worker may not have been restarted, the domain may be mapped to a different PHP pool, or a cached page may be hiding the change. Ask the host to check the pool assigned to the site.

How to patch PHP2ShellcPanel and Plesk guide

A practical sequence

A safe upgrade order for a WordPress site

Back up the site, test the target PHP branch on staging, and check plugin and theme compatibility. Update PHP to a fixed release, restart every worker, and verify the web version before changing WordPress code. Then update WordPress core, plugins, and themes, and check the site for fatal errors and deprecation warnings.

A PHP upgrade is not a substitute for WordPress maintenance, and WordPress maintenance is not a substitute for the PHP update. Both matter. If the host offers only an end-of-life branch, that is a reason to move to a host that offers a supported PHP release.

  1. 1Back up and test on staging.
  2. 2Update PHP to a fixed release.
  3. 3Restart PHP-FPM, Apache, or containers.
  4. 4Verify the web PHP version.
  5. 5Update WordPress core, plugins, and themes.
  6. 6Check logs and the front end after the change.

Keep reading

Related guides

PHP2Shell checker

The combined advisory, affected versions, and a read-only check for any public site.

Read guide

cPanel and Plesk

Switch PHP on shared hosting, verify the change, and contact support with the right questions.

Read guide

Patch PHP2Shell

Update PHP on Linux, Docker, and Windows, restart every worker, and verify the web SAPI.

Read guide

WordPress PHP requirements

The minimum PHP version for each WordPress release and how WordPress chooses its PHP branch.

Read guide

FAQ

PHP2Shell and WordPress questions

Short answers for site owners, agencies, and managed WordPress hosts.

Is PHP2Shell a WordPress vulnerability?
No. PHP2Shell is a pair of vulnerabilities in the PHP runtime, CVE-2026-109618 and CVE-2026-109619. WordPress sites are affected when they run on an affected PHP version, but WordPress core, plugins, and themes are not the source of the flaw.
Does updating WordPress fix PHP2Shell?
No. Updating WordPress, a security plugin, or a web application firewall does not change the PHP binary. The server must install a fixed PHP release and restart every PHP worker.
How do I check my WordPress PHP version?
In the WordPress admin, open Tools > Site Health > Info > Server. You can also run wp --info with WP-CLI, but that reports the command-line environment. Check the web SAPI with Site Health, the hosting panel, or a temporary PHP file.
Why does Site Health still show the old PHP version after the update?
The update may not have been installed, the PHP-FPM or Apache worker may not have been restarted, or the domain may be assigned to a different PHP pool. Shared and managed hosts can run several PHP versions. Ask the host to confirm the version and the restart for the site's pool.

Official references

This guide summarizes the official PHP advisory for site owners. It is not a security audit. A patched PHP version does not by itself prove that a site is secure.

Check another site

The checker is free and does not require an account.

Back to the PHP version checker