PHP2Shell and WordPress: is your WordPress site affected?

Is my WordPress site affected by PHP2Shell?

Your WordPress site is affected if the PHP version it runs on is below the fixed release for its branch, or is PHP 8.1 or older without a vendor patch. PHP2Shell is a pair of flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619), so every WordPress site on an unpatched PHP is in scope, whatever its theme, plugins or WordPress version.

How do I check my WordPress site for PHP2Shell in two minutes?

You need an administrator account. You don’t need server access.

1. In the WordPress admin, open Tools → Site Health.
2. Switch to the Info tab and expand Server.
3. Note the PHP version and the PHP SAPI (how PHP runs, such as FPM or Apache).
4. Enter both in the PHP2Shell checker. It compares them with the fixed releases and tells you what to do next.

Site Health shows the PHP that actually serves your website, which is the version that matters. A php -v on the server can report a different command-line PHP. More ways to check: check PHP version.

Will updating WordPress, my theme or plugins fix PHP2Shell?

No. PHP2Shell is in the PHP runtime underneath WordPress. WordPress core, theme and plugin updates don’t change the PHP version your server runs. Keep them updated anyway, but the PHP2Shell fix comes only from updating PHP to a fixed release or your vendor’s patched package.

Is PHP2Shell the same as wp2shell?

No. wp2shell is a separate vulnerability in WordPress core, fixed by updating WordPress. PHP2Shell is in PHP and is fixed by updating PHP. Search engines sometimes show wp2shell results when you search for “php2shell wordpress”, so check both:

• wp2shell: WordPress core is up to date (Dashboard → Updates).
• PHP2Shell: the PHP version in Site Health is at or above the fixed release for its branch.

Who updates PHP for my WordPress site?

It depends on how your site is hosted.

If you only have WordPress admin access, send your host the ready-made request in the PHP2Shell patch guide.

Will updating PHP break my WordPress site?

Moving to a newer release in the same branch, such as 8.3.30 to 8.3.36, contains fixes and rarely breaks WordPress. Changing branch, such as 7.4 to 8.3, can break older themes and plugins. Before a branch change, back up the site and test on a staging copy if your host offers one. See WordPress PHP version for how to switch safely.

Does a security plugin or Cloudflare protect WordPress from PHP2Shell?

They can reduce exposure but are not a fix. Cloudflare reports that its WAF blocks known attack patterns and that it observed attack attempts before the patch. A WordPress security plugin runs on top of PHP, so it can’t patch the PHP runtime, and PHP has confirmed at least one attack path that runs before any application code. Until you update, see the CVE-2026-109618 workaround for official stopgaps and their limits.

How do I check whether my WordPress site was already hacked?

Updating PHP stops new attacks but says nothing about the past. In WordPress, look for:

• Users: administrator accounts you don’t recognise (Users → filter by Administrator).
• Uploads: .php files inside wp-content/uploads, which should hold only media.
• Must-use plugins: unknown files in wp-content/mu-plugins, which don’t appear in the normal plugin list.
• Plugins and themes: anything you didn’t install, and recently changed files you didn’t touch.

If you find something, follow the full compromise checklist before changing anything, and change all passwords and the keys in wp-config.php after cleaning up.

What should agencies tell WordPress clients?

Tell them what you have done, not just what the risk is: which PHP version each site now runs, that it is at or above the fixed release, and that you checked for signs of compromise. The PHP2Shell patch guide includes a client notice you can adapt, and the PHP2Shell checker gives a quick verdict per site.