PHP2Shell.fyi Check a site

PHP2Shell on WordPress and WooCommerce

PHP2Shell is a flaw in PHP, the program WordPress runs on. A WordPress site is exposed when its PHP is not fixed. Updating WordPress, plugins or themes does not change PHP. You or your host have to update PHP itself.

Last reviewed . Rules of .

What to do

  1. Find the PHP version your site runs (see below).
  2. Ask your host for a fixed PHP build, or update PHP yourself.
  3. Make sure PHP restarts after the update.
  4. Run the checker again, and ask your host to confirm the fix.

With both flaws, the researchers showed attacks without a login on WordPress. They used the latest WordPress container image at the time.

Find your PHP version

In the dashboard, go to Tools › Site Health, open the Info tab, expand Server and look at PHP version. This is the PHP that serves your site.

With WP-CLI, run:

wp cli info

It prints the PHP binary and version that WP-CLI uses, which is the command-line PHP. Your web server can run a different PHP, so for the website, trust the Site Health value.

Green Site Health does not mean fixed

Site Health warns when PHP is outdated, but it looks only at the branch, such as 8.3, not at the patch level. It cannot tell a fixed 8.3.36 from an unfixed 8.3.35.

On 2026-10-22 we asked the WordPress.org PHP check about 8.3.35 and 8.3.36. It gave the same answer for both. A host’s patched build can also keep an old number. Read the exact version, and confirm the fix with your host.

Which PHP to ask for

WordPress recommends PHP 8.3 or newer. Old setups can still run it on PHP 7.4 and newer, but PHP 8.1 and older get no new releases.

See Fixed versions for all branches.

How to update PHP

WordPress.org gives these steps:

  1. Back up your site.
  2. Update WordPress, themes and plugins.
  3. Check PHP compatibility, for example with the PHP Compatibility Checker plugin, and fix problems with the theme or plugin authors.
  4. Change the PHP version in your host's settings, or ask your host to do it. WordPress.org lists instructions for many hosts and has an email text you can send.

On shared or managed hosting, ask your host this:

Which PHP build serves my site, and does it include the fixes
for CVE-2026-109618 and CVE-2026-109619?

Then restart every PHP process and rebuild any containers. After you update has the details.

WooCommerce

WooCommerce runs inside WordPress on the same PHP, so the fix is the same PHP update.

To see the PHP version, go to WooCommerce › Status and look at PHP version in the Server Environment section. As with Site Health, read the exact number.

WooCommerce 11.2.1 needs PHP 7.4 or newer. Follow the WordPress advice instead: PHP 8.3 or newer, which means 8.3.36 or a later fixed branch.

Shops hold customer data and payment keys. The researchers showed that the flaw can leak passwords, login tokens, API keys and certificates from server memory. If your shop ran on unfixed PHP, rotate your payment provider keys, WooCommerce REST API keys and other secrets after the update (our advice).

What the checker can see

For WordPress, the checker looks for:

For WooCommerce, it looks for a generator tag that names WooCommerce and for assets under /wp-content/plugins/woocommerce/. A WooCommerce result links to this page.

These signs tell the checker that PHP is probably in use, and nothing more. The verdict depends on the PHP version the server reports. See how the checker works.

Check your site

The php2shell.fyi checker sends at most three ordinary GET requests to your site and lists every PHP signal it saw. It cannot see inside your server, so ask your host to confirm the result.

Sources