PHP2Shell & WordPress: What Every Site Owner Must Do Now

WordPress powers a huge share of the web, and it is confirmed vulnerable to PHP2Shell (researchers demonstrated unauthenticated RCE against WordPress 7.1.2). If you run WordPress, this is urgent.

The key thing to understand

PHP2Shell is a flaw in PHP itself, not in WordPress core or any plugin. That means:

• Updating WordPress, themes and plugins is good hygiene but does not fix this bug.
• A security plugin or “maintenance mode” won't stop it — the exploit runs in the PHP engine before WordPress loads.
• The fix is to update the PHP version your site runs on.

Your action plan

1. Check your PHP version. Tools → Site Health → Info → Server, or our scanner.
2. Update PHP via your host's dashboard (cPanel, Plesk, or a managed-host PHP switch) to 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or newer. See the environment guide.
3. Test your site afterward — a PHP point update rarely breaks WordPress, but check a staging copy if you're on an old branch and need a bigger jump.
4. Keep backups and watch logs for suspicious multipart/form-data POSTs (the attack vector).

WooCommerce stores

WooCommerce runs on WordPress + PHP, so the same exposure applies — with the added stakes of customer and payment data. See PHP2Shell & e-commerce.