PHP2Shell is a bug in PHP itself, not in WordPress - updating your plugins and themes won't close it. Here's what WordPress site owners actually need to check and do.
Wiz demonstrated PHP2Shell against the latest WordPress container image, proving the flaw sits beneath the CMS, in PHP core itself.
WordPress's own Site Health screen shows the server's PHP version - that's your starting point, not a plugin changelog.
On shared hosting, your host controls the PHP version - you may need to ask them directly or change a setting yourself.
PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, is an unauthenticated remote code execution flaw in PHP core, not in WordPress itself. The bug is application-agnostic, and Wiz Research specifically tested it against the latest WordPress, Drupal and Joomla container images to prove that the application layer makes no difference - see our full PHP2Shell vulnerability explainer for the technical detail behind both CVEs.
The common mistake is thinking a WordPress core update, a theme refresh and a round of plugin updates covers you. That patches an entirely different layer. The actual fix is a PHP version upgrade, to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a backport if you're stuck on an end-of-life branch - WordPress updates alone don't touch the PHP interpreter running underneath.
This matters at scale because WordPress runs such a large share of the web, and because Wiz estimates PHP itself powers around 70% of all websites. A huge number of WordPress installs are quietly sitting on an exposed PHP version without the site owner ever realising, because nothing in the WordPress admin screen flags it.
The urgency is real: this is unauthenticated RCE, a public proof-of-concept exists, and early exploitation attempts have already been reported. PHP's own advice is to upgrade immediately, stating there are "no complete mitigations" short of patching - this isn't a routine update to get to eventually. If you need a server patched today rather than assessed first, see our emergency PHP patching service.
None of these checks require deep technical knowledge, but they do need to happen in the right order - checking the wrong number, or in the wrong place, is how sites end up believing they're safe when they're not.
In wp-admin, go to Tools > Site Health > Info > Server to see the PHP version your site is actually running - more reliable than guessing from your hosting plan name.
If you or your host check php -v over SSH, remember that can differ from what the live web server (FPM or mod_php) runs for real requests - the Site Health number reflects what the site genuinely uses.
On shared hosting, your provider typically controls the PHP version - check your control panel (cPanel MultiPHP or Plesk PHP settings) or ask your host directly. On a VPS or dedicated server, upgrading PHP is your responsibility, or ours if we manage it for you.
Jumping to PHP 8.2 or later can occasionally surface a plugin or theme that hasn't been updated for newer PHP - a reason to test the change properly, not a reason to delay it.
We take a full, verified backup before touching the PHP version or plugin compatibility, so a rollback is always possible if something unexpected surfaces.
We check your active plugins and theme against the new PHP version before switching it live, rather than upgrading first and finding out what breaks afterwards.
From checking your real PHP version to a verified upgrade - our process is built to avoid surprises.
We confirm the PHP version your WordPress site genuinely runs via Site Health and server-side checks, not just your hosting plan description.
A full, verified backup is taken before any PHP version change, so there's always a safe way back.
We check your active plugins and theme against the target PHP version, flagging anything that needs updating or replacing first.
We move your site to a patched PHP version, or apply the right backport, and confirm it's live and working correctly.
As a London-based managed IT, web development and cyber security provider for UK SMEs, we work with WordPress daily, so we know the difference between a CMS-level fix and a server-level one.
We check your real PHP version properly, because Site Health, CLI and your hosting plan description can all tell a slightly different story, and only one of them reflects what's actually serving your visitors.
We test plugin and theme compatibility before switching the PHP version live, rather than upgrading first and discovering what breaks on your checkout or contact form afterwards.
If you're on shared hosting, we'll tell you plainly whether the fix is a setting in your control panel or something that needs a conversation with your host, rather than leaving you to guess.
A full, verified backup comes before any change, so if anything does misbehave after the PHP upgrade, we can roll back cleanly rather than troubleshoot a live, broken site.
We also check for signs of compromise - an unfamiliar admin user, unexpected files in wp-content/uploads, modified core files - because exploitation attempts were reported before patches existed.
Beyond the immediate fix, our website maintenance services keep your WordPress core, plugins and PHP version properly maintained going forward, so this doesn't become a recurring scramble.
Every fix is scoped to your hosting setup and plugin stack - here's a rough guide to where most WordPress sites land.
PHP version check and compromise scan
Assess, plus backup and PHP upgrade
Larger sites, many plugins or an agency-managed estate
We treat PHP2Shell as a PHP-level problem that happens to run under WordPress. Here's what sets our fix apart.
We won't tell you to update a plugin when the real issue is the PHP version underneath it.
Site Health, CLI and hosting plan descriptions can disagree - we confirm what's genuinely serving your visitors.
Plugins and themes checked against the new PHP version before it goes live, not after something breaks.
A verified backup always comes first, so a rollback is possible if anything misbehaves.
We know when the fix is a control panel setting and when it needs a conversation with your host.
We look for signs of prior compromise, not just whether the version number is now correct.
You keep full ownership of your WordPress install, hosting account and content throughout.
A one-off fix doesn't commit you to anything ongoing unless you choose website maintenance too.
A clear written record of what was checked, fixed and verified, in plain English.
We fix WordPress PHP2Shell exposure for site owners across the UK remotely, so your hosting location doesn't change how thoroughly the job gets done. Whether you're on shared hosting, a managed WordPress platform or your own VPS, we scope the fix to your actual setup rather than a one-size-fits-all script. Because we also design and build WordPress sites through our WordPress website design service, we understand how plugin and theme choices interact with a PHP version change.
This matters because a WordPress site rarely has just one thing wrong with it. A site running an old, exposed PHP version has often also missed plugin updates, a stale backup routine or an expired SSL certificate. Our website maintenance services look after all of that together, so a PHP2Shell fix can be the start of properly maintained WordPress, not a one-off panic.
WordPress owners generally choose between three approaches once they realise updating plugins alone isn't enough.
Update WordPress and hope: keeps your CMS layer current, but does nothing for a bug that sits in PHP core itself - Wiz demonstrated the flaw against the latest WordPress image specifically.
Ask your host to handle PHP: works if your host manages it centrally, but many shared hosting control panels leave the PHP version as a setting you have to change yourself.
Get an independent fix: a checked PHP version, a verified backup, compatibility-tested plugins and a confirmed working upgrade, with a written report at the end.
What to check before assuming you're safe: whether Site Health shows a genuinely patched version, whether your plugins have been tested against it, and whether anyone's looked for signs of compromise from before the fix went in.
Coverage
We fix WordPress PHP2Shell exposure for businesses across the UK remotely, with London-based on-site availability for businesses that want a face-to-face meeting.
wordpress php2shell fix
Checking and upgrading the real PHP version behind a WordPress site, since the PHP2Shell bug sits in PHP core, not in WordPress itself.
wordpress php update uk
Remote-first WordPress PHP version checks and upgrades for UK site owners, with London-based on-site availability when it helps.
Got questions about PHP2Shell and WordPress? We've answered the most common ones below. If you need more detail, get in touch.
WordPress isn't the vulnerable component, but any WordPress site running on an affected PHP version is exposed. Wiz specifically demonstrated the flaw against the latest WordPress container image.
No. PHP2Shell is a bug in PHP core, beneath WordPress entirely. Updating the CMS, theme or plugins doesn't touch the PHP version your server runs.
In wp-admin, go to Tools > Site Health > Info > Server. That reflects the version actually serving your visitors, which can differ from a CLI check or your hosting plan description.
Usually your host controls the PHP version, available as a setting in your control panel such as cPanel MultiPHP or Plesk. If you can't find or change it, ask your host directly.
It can, occasionally, if a plugin or theme hasn't been updated for newer PHP. That's why we test compatibility before switching the live version, not after.
Yes, always. We take a full, verified backup before any PHP change, so a clean rollback is possible if anything misbehaves.
Look for an admin user you don't recognise, unfamiliar files inside wp-content/uploads, modified core files, or unexplained slowness and server errors.
Some older shared hosting plans lag behind. If that's the case, it's worth asking your host directly, or we can advise on moving to hosting that supports a currently maintained PHP version.
Yes, we regularly check and fix PHP version exposure across multiple WordPress sites for owners and agencies, coordinating backups and compatibility testing across the whole set.
UK-based support for WordPress site owners checking and fixing their PHP2Shell exposure.
We believe that communication is key to any successful partnership. Submit your details and one of our friendly team members will be in touch with you shortly.
Submit your details and one of our friendly team members will be in touch with you shortly
Powered by industry-leading technologies including SolarWinds, Cloudflare, BitDefender, AWS, Microsoft Azure, and Cisco Meraki to deliver secure, scalable, and reliable IT solutions.
22 Oct, 2026
Fixed wireless access delivers business internet over radio rather than a cable into the building, and for many UK businesses it is a genuine primary...
21 Oct, 2026
Row-level security reporting means building dashboards that show each person only the rows of data they are entitled to see their own region, their own team,...
20 Oct, 2026
Good LLM integration architecture is what separates an AI feature that keeps working for years from one that becomes a maintenance burden within months. The...