WordPress and the PHP vulnerability: what to arrange today

WordPress is written in PHP. PHP builds every requested page on the server. CVE-2026-109618 and CVE-2026-109619 affect PHP itself, in all versions from PHP 5, reports Help Net Security. An attacker needs no weak plugin: the server itself is the target.

Log in and open Tools > Site Health > Info, then Server. The PHP version appears there, for example 8.2.34.

• 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later in the same branch: updated.
• A lower number in those branches: ask your host to update today.
• 8.1 or lower: no fix will arrive. Upgrade to a newer branch.

Cannot access administration? The free Marketing Scan PHP check gives an initial outside indication.

Shared hosts update PHP centrally. Most also let you select a branch, for example 8.3, in the panel while the host provides the latest patch within it.

With your own server or VPS, the developer or administrator is responsible. Request confirmation including the exact version.

PHP 7.4 or 8.0 users face a bigger jump. Older plugins and themes sometimes fail on 8.2 or later. Proceed safely:

1. make a complete backup of files and database;
2. first update WordPress, theme and plugins to their latest versions;
3. preferably test a copy in a staging environment, available from most hosts;
4. switch PHP and test the homepage, contact form, cart and payment.

Long-unmaintained plugins pose the greatest risk. Replace them sooner rather than later.

Shops store customer details and orders. An attacker exploiting PHP could read those records or manipulate checkout. After updating, check:

• orders and payments complete normally;
• no unknown administrators appear under Users;
• your payment provider (Mollie, Stripe, Payconiq) reports no anomalies.

A personal-data breach must be reported to Belgium's Data Protection Authority within 72 hours.

A security plugin runs in PHP after the point of exploitation and cannot patch PHP itself. An upstream firewall such as Cloudflare or your host's can slow attacks temporarily. Patchstack nevertheless states that updating is the only complete solution.

PHP flaws this large are rare; plugin flaws are not. These habits help:

• Choose an actively supported PHP branch so new flaws receive fixes promptly.
• Enable automatic updates for minor WordPress releases and trusted plugins.
• Clean up. Every disabled or forgotten plugin is an open door.
• Arrange weekly checks. A free Marketing Scan account checks your site weekly, including visible software versions, and notifies you of changes.

The difference between a site forced offline and one updated the same day rarely lies in technology. It lies in clear responsibility and prompt information.