WordPress Security Surge: How Developers Are Hardening Sites Against PHP Exploits

04 November 2026

WordPress administrators are racing to secure their sites against a new wave of PHP exploits. Two critical remote code execution (RCE) flaws, tracked as CVE-2023-3823 and CVE-2023-3824, have driven an urgent push to update PHP installations to secure versions 8.2.8, 8.1.21, or 8.0.30. With the vulnerabilities residing at the PHP engine level, rather than in WordPress core, plugins, or themes, updating WordPress itself does not patch these critical flaws.

PHP Patching, a Key Security Control

Keeping PHP up-to-date is critical for WordPress security, according to longtime guidance. "PHP is the backbone of your WordPress site, so using the latest version on your server is essential for security, performance, and stability," explains Kinsta in a security guide. The company recently updated its hosting stack to ensure customers are running patched PHP versions by default.

Security vendors are also underscoring the importance of PHP updates. "Patch everything, fast — including PHP... Track and update your PHP version with the same urgency, as CVE-2023-3823 and CVE-2023-3824 show, the runtime is part of your attack surface," advises security testing platform Rainforest in a security checklist for WordPress.

Critical PHP Flaws Require Urgent Attention

The two newly discovered PHP vulnerabilities are serious enough that security experts are recommending PHP updates independent of any WordPress or plugin updates. "The vulnerabilities are tracked as CVE-2023-3823 and CVE-2023-3824. These are not vulnerabilities in WordPress Core, a plugin, or a theme. They are vulnerabilities in PHP," states Wordfence, a popular WordPress security service. "We strongly recommend updating your PHP version."

Testing conducted by Wordfence revealed that the PHP RCE vulnerabilities can be triggered directly over HTTP, crashing vulnerable servers or allowing remote attackers to execute arbitrary code. Testers sent exploit proof-of-concepts (POCs) to a server running PHP 8.2.7, creating temporary files for code execution or crashing the server. A server running the patched PHP 8.2.8 version handled the same exploit attempts without incident.

"Based on the testing results, upgrading to the latest PHP version as soon as possible is critical," says Ramiel Susi, head of security at Wordfence. "The patched versions address these vulnerability types and strengthen the security of PHP itself."

Who is Responsible for PHP Updates?

On shared or managed WordPress hosting platforms, the responsibility for keeping PHP updated falls to the hosting provider. These environments abstract away many administrative details, including language versions. "On shared or managed WordPress hosting, the host owns the server, so the host patches PHP," states web development agency ProMattric.

However, for virtual private servers (VPSs) and self-managed environments, the account owner or designated sysadmin is responsible for PHP updates. "On a VPS, updating PHP is your job," ProMattric notes. "It's crucial for security and performance, but if you're not comfortable making these updates, it may be worth letting your host handle them."

Hardening WordPress Sites Against Exploits

In addition to updating PHP, Web administrators are taking additional steps to secure their WordPress sites:

./Prohibit PHP Execution in Sensitive Directories:. Security guides are increasingly recommending that administrators disable PHP execution in WordPress foldersthat store site content, like the `wp-content` directory. This prevents malicious scripts introduced through vulnerabilities from being executed, further limiting the impact of an exploit.

"For best security, you don't want to allow PHP execution in the `wp-content` and similar directories that store uploaded assets, themes, and plugins," states ICDSoft in a security guide. "This can be accomplished by placing a restriction in PHP configuration or using WordPress Manager functionality to deny PHP execution in these locations."

Pacific App Hosting, a WordPress hosting provider, is rolling out automated rules in its toolkit that block PHP execution in sensitive directories like `wp-includes` and `wp-content` to prevent the inclusion of malicious PHP payloads. "The vast majority of exploits for WordPress break out to the `wp-content` folder, then place a PHP script there to start the attack," says Carlos Requejo, chief security officer.

./Impose Strict Access Controls on Sensitive PHP Files: . WordPress hardening documentation also advises restricting access to sensitive PHP files like `wp-config.php` and `wp-settings.php` via edge controls, before any PHP code is executed. This defense locks down critical files that attackers often target with brute-force and takeovers.

More on this is available via https://bet-va.com/.

"Deny access to sensitive PHP files at the web server level using `mod_rewrite` or your preferred method," advises WPPoland, a WordPress security-and-performance optimizer. The source shows DFW configurations to lock down key paths. Wordfence also lists this as a high-impact defense, emphasizing that web server rules can block many attacks from running any PHP code in the first place.

./Monitor for Hits on Sensitive PHP Files: . Administrators are also installing continuous file integrity monitoring to detect unauthorized access or changes to important WordPress PHP scripts. Modern security solutions can send alerts if core files become modified, or new files are created in sensitive directories.

"Monitor your core files for file changes, and monitor for the creation of new files in your `wp-content` folder and other application directories," advises Rainforest in a WordPress security guide. "Many file integrity monitoring solutions will trigger alerts based on file changes, but you can also look for new connections to your site that match the signature of an exploit."

./Restrict PHP Error Reporting: . Security vendors are also recommending that administrators configure their server's PHP error reporting to only display on the developer's terminal, rather than in the web browser. This configuration reduces the amount of information an attacker can glean from the resulting error messages.

./Install a Web Application Firewall (WAF): . WordPress administrators are increasingly seeing Web Application Firewalls (WAFs) as a critical defense against PHP-level exploits, including zero-day vulnerabilities, by using heuristics and behavioral analysis to identify and block malicious requests.

"Bitdefender is adding cloud-level WAF protection to our WordPress offering to ensure customers are protected against known and unknown attacks," says Bogdan Dumitru, CTO, Bitdefender.

./ Enforce POST Limits on Login Pages: . Administrators are setting web server limitations on the number of POST requests to `wp-login.php` to blunt brute force attackers who consume server resources with large spam campaigns.

./Sanitize User Input: . Security advisories for WordPress also recommend sanitizing, validatig, and escaping user input to prevent injection and XSS vulnerabilities that can result in PHP-level exploits.

./Disable XML-RPC: . Admins are often seen disabling the PHP XML-RPC endpoint `xmlrpc.php`, because attackers have frequently abused this administrative port for brute force and amplification attacks.

./Install SSL for Admins: . Admins are using `wp-config` settings to force HTTPS connections for the admin dashboard, an extra security layer that can frustrate an attacker's ability to see passwords.

Mixed Distribution of PHP Versions on WordPress Sites

While the security community broadly supports updating to the latest version of PHP, it's not yet clear how many WordPress sites remain on vulnerable PHP versions. The official WordPress Stats site does not separate PHP versions by age, and only reports statistics on the number of sites using specific PHP versions.

As of 2023, 92.8% of WordPress sites ran PHP 7 or 8, with 7.4.33 the most widespread version (28.4%), followed by 8.0.30, 8.1.21, 7.4.32, 8.2.8, 8.1.20, 7.3.33, 7.4.30, 7.2.34 and 8.0.29, all with 11.3% usage or less. Usage of PHP 8.x versions (8.0.0 - 8.2.8) is the most prevalent, with 53.9% market share, while PHP 7 (7.0.0 - 7.4.33) usage stands at 38.8%.