03 November 2026
One in three WordPress sites reporting to WordPress.org are running a version of PHP that no longer receives security patches, leaving them vulnerable to public exploits. Most at risk are systems on PHP 8.0, where security support from the PHP project ends on 30 November 2023. Updates to WordPress itself do not upgrade the PHP version the site relies on. The problem is not limited to reporting sites, either: a separate survey by W3Techs found that more than 60% of publicly reachable WordPress instances are still running an outdated, unsupported version.
What the Data Shows
As of 3 November 2023, 32.8% of WordPress sites that report to WordPress.org use a PHP version no longer covered by the PHP project, according to data analysis from W3Techs. More than a fifth - 21.3% are using PHP 8.0, whose security support expires this year on 30 November, with no backporting of subsequent patches.
Separately, W3Techs examined the PHP versions in use by over 316,500 WordPress instances with visible version headers in its scan of the public internet, and reached a similar conclusion: over 60% of reachable WordPress sites are using a deprecated, out-of-support PHP version. Further, if WordPress 5.9 is included in the count of "maintained versions" even though it is no longer supported as of 20 March 2023, only 31% of the WordPress PHP sites W3Techs observed were in an actively maintained state. The single most common PHP version in that survey was PHP 7.4, on 20% of the sites - even though security support for PHP 7.4 ended in November 2022.
Why WordPress Updates Don't Fix PHP Risks
The WordPress software itself has been a major focus of recent security improvements and updates but by itself, this does not solve open risks in the underlying PHP environment that the WordPress software relies on. In a 2023 security notice, WordPress stated directly: "Upgrading WordPress does not upgrade your PHP version, and your version of PHP is separate from the version of MySQL" and "even if you are running the latest WordPress, using outdated PHP may expose your site to security vulnerabilities."
Less than 15% of the WordPress PHP sites in the W3Techs survey were using a WordPress version released within the last twelve months; including WordPress 5.9, about 31% were using a version that was at least still receiving security updates when the data was collected. Even so, most sites using an up-to-date WordPress release were still running an unsupported version of PHP. That is because updating WordPress does not update the PHP runtime itself, which is again separated from the server it runs on and the database that hosts the WordPress data.
Why This Risks Matter Now
The risks are not theoretical. In an October 2023 security notice headlined "WordPress Update: Critical PHP Security Update," the WordPress project announced that the PHP project had fixed critical vulnerabilities known as PHP2Shell in the most recent stable versions of the PHP 8.x branch. The vulnerabilities are not specific to WordPress, WordPress pointed out - they affect any server that hosts a PHP application. However, that also means that updating WordPress itself would not address the risk. The fix requires upgrading PHP itself.
The PHP2Shell vulnerabilities are in "most" recent releases in the PHP 8.0, 8.1, 8.2, and 8.3 branches, but PHP 8.3 is the only one of these versions to be approved for active use by WordPress as of November 2023. According to the WordPress hosting guidance, PHP 8.3 is supported as of WordPress 5.9, released in March 2023 and no longer itself receiving regular updates. PHP 8.2 support is available in WordPress 5.7 and later, while PHP 8.1 has moved to security-only support as of 30 November 2022. Signals from WordPress host guidance show that WordPress Core only supports the PHP 8.x series, with WordPress 5.7 the oldest version still receiving updates that supports 8.1 and later, as of November 2023.
The Compatibility Trap
With WordPress sites typically relying on multiple themes and plugins, an upgrade of the PHP runtime can cause compatibility issues that WordPress.org has no control over fixing. According to the WordPress.org upgrade guidance, a recent data sample showed one in four sites experienced some form of compatibility issue - specific issues can include errors, a missing site, slow performance, or a white screen. WordPress can't guarantee an update will be a smooth process.
Often the first step is testing compatibility in a staging environment with a backup - but even that doesn't always catch a compatibility redflag in time. Before proceeding with an upgrade, WordPress advises sites to disabling theme and plugin updates, identifying theme and plugin versions compatible with the upgrade target, and backing up the site.
What Hosts and Site Owners Need to Watch
For WordPress sites running on PHP 8.0, every single day of 2023 without an update brings increased risk. While critical infrastructure as a rule should be even more careful about upgrades, the numbers show that with 21.3% of reporting sites still at risk, the WordPress community has some important work to do.
The WordPress hosting guidance includes a table of PHP versions, WordPress core versions that support them, and their support status. For hosts and site owners, doing the triage of any configuration that breaks after an upgrade is a critical part of managing the increasing risk of keeping up with supported PHP versions. Securing WordPress sites starts with understanding the independent update cycles of the site software, the server software it runs on, the database it uses, and the web server itself.
