Is Your WordPress Site Vulnerable to PHP2Shell? Free Check for CVE-2026-109618 and CVE-2026-109619

Why this affects your WordPress site

This post is for site owners, not just developers. It explains what is at stake, how to find out in a few minutes whether you are exposed, and exactly what to ask your host to do.

WordPress is software written in PHP. Your host runs PHP on the server, and that PHP is what has the bug. It does not matter how well your theme and plugins are updated. If the server's PHP is unpatched, the site is exposed.

If an attacker gets in, they can read your wp-config.php (which holds your database password), add admin users, plant backdoors, send spam from your server or redirect your visitors.

Step 1: Find out if you are vulnerable

The quickest way is the free PHP2Shell Guard plugin. It looks at the PHP your website actually runs, not what a hosting panel says, and shows a clear red, amber or green result.

1. 01

   Download the plugin

   PHP2Shell Guard (free ZIP).

2. 02

   Upload and activate

   In WordPress go to Plugins → Add New → Upload Plugin, choose the zip and activate it.

3. 03

   Open the check

   Open Tools → PHP2Shell Guard.

How to read the result

• Green (patched): your PHP includes the fix. You are done, and the plugin can stay installed as a safety net.
• Red (vulnerable): your PHP is older than the fixed release. Go to step 2.
• Red (unsupported): you run PHP 8.1 or older, which gets no official fix. Ask your host to move you to PHP 8.3 or newer.
• Amber (cannot tell): the plugin cannot confirm your build. Ask your host.

The plugin is read-only. It never changes your server or your site files.

Step 2: Get PHP updated

You need PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or any newer release on that branch. On shared hosting, you usually change the PHP version in your hosting control panel or ask support. You can copy this message to your host:

Please update PHP for my account to a release that fixes CVE-2026-109618 and CVE-2026-109619 (8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer), or confirm in writing that your build includes a backport of the fix. Please also restart PHP afterwards.

Some hosts apply fixes without changing the version number. If yours says so, ask them to confirm it for both CVE numbers, and snooze the plugin's warning until the version shows a fixed release.

Step 3: Reduce the risk while you wait

If the update is not possible today, the PHP team recommends stopgap settings. They reduce exposure but do not make a server safe. PHP2Shell Guard generates them for your exact server (php.ini, PHP-FPM, Apache, .htaccess or nginx), ready to copy or send to your host. The main ones are:

• Turn off session.upload_progress.enabled
• Lower post_max_size (8M if you take no uploads, 32M if you do)
• If your site accepts no file uploads, turn off file_uploads
• On PHP 8.5, set fatal_error_backtraces to 0

These must go in php.ini, the PHP-FPM pool or the Apache config, followed by a restart. A plugin or .user.ini file cannot apply them in time, because the bug triggers before WordPress loads.

Step 4: Check for signs of an attack

• Admin users you do not recognise (Users → All Users)
• Recently changed or unknown files in your WordPress folders
• Repeated "Allowed memory size exhausted" errors in your PHP error log
• Unusual spikes of POST requests in your hosting access log

If anything looks wrong, update PHP first, then change your database password, WordPress salts, admin passwords and API keys, and restore from a clean backup if needed.

Common questions

1. 01

   Can a security plugin block PHP2Shell?

   No. The attack happens before WordPress and every plugin load. Only a PHP update fixes it. A plugin can tell you if you are exposed and what to change.

2. 02

   I use a managed WordPress host. Do I still need to check?

   Yes. Many managed hosts patch quickly, but confirming takes two minutes. Run the check and, if it is green, you are covered.

3. 03

   Which PHP versions are fixed?

   8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older have no official fix, so upgrade. PHP 8.2 reaches end of life on 31 December 2026, so 8.3 or newer is the safer choice.

4. 04

   Why does the plugin disagree with my host's panel?

   Panels can show a default version while your site runs another, and Linux distributions often backport fixes without changing the number. Use the plugin report as the evidence to bring to your host.

5. 05

   Does the plugin slow my site down?

   No. It only runs in the admin area and WP-CLI, never on pages your visitors see.

Download PHP2Shell Guard (free) and find out where your site stands.

Sources: PHP security advisory, 21 Oct 2026, Sophos, JFrog.