03 November 2026
WordPress site owners need to verify their PHP version and apply an emergency PHP patch released this week that fixes two critical vulnerabilities. The issue, identified by the PHP project on October 28, 2023, affects any server that hosts a PHP application, including those running WordPress.
What Happened?
PHP, a programming language used by millions of websites, released a critical security update patching two severe vulnerabilities. WordPress itself is not impacted, but WordPress sites remain exposed as they all run on PHP. Updating WordPress or its plugins will not patch the PHP issue.
WordPress and PHP: What You Need to Know
WordPress sites are not directly vulnerable to these PHP bugs, because the issue lies in the PHP language that WordPress sites depend on. Simply installing the latest WordPress update will not address the PHP vulnerability. "Unfortunately, updating WordPress or any WordPress plugins won't solve this issue," says WordPress in its news report on the PHP security release. "This is an issue in the PHP programming language itself, not a flaw with WordPress or a specific plugin." WordPress did not announce plans for addressing these issues through a platform update.
PHP's Emergency Release: What Was Fixed?
The emergency update from PHP fixes vulnerabilities in PHP 8.2.12, 8.1.25, and 8.0.30. If you're running PHP 7.4 or older, you're already outside the window for security updates; however, WordPress.org advises neither WordPress.org nor your site are safe unless the server is running a version of PHP from the patch list. Specifically, everyone using a PHP version from the list must install the corresponding update from PHP. PHP 7.4 was not included in the patch list, and WordPress.org was not able to confirm support for all recent PHP 7.4 versions in the days immediately following the release.
Checking Your PHP Version
To determine which version of PHP your site is currently running, go to Tools > Site Health > Info > Server in your WordPress dashboard.
More on this is available via accurate 1xbet predictions.
What If Your Host Isn't Running a Patched Version?
If you need to stay on a vulnerable version of PHP, WordPress.org recommends the following tactics:
"Check with your hosting provider as they may be applying a Web Application Firewall (WAF) rule to mitigate these vulnerabilities." This is unlikely to be a complete fix in the long-term, however, because well-designed WAF implementations are inherently reactive; they rely on observed attack patterns.
"If you're unable to update immediately, the most secure option is to bring your site offline with a maintenance plugin, or by contacting your host, until the update can be installed." It's a drastic measure, but not an unreasonable one in this case.
"If certain configurations prevent you from installing the recommended PHP version, consider reverting to an earlier PHP version listed above instead of doing nothing."
