Critical PHP Vulnerabilities to Impact All WordPress Sites
PHP is set to release an update addressing two critical vulnerabilities (CVSS 9.2), affecting all WordPress sites due to PHP's foundational role in the platform.
The PHP security team has announced an urgent security release scheduled for October 21, 2026, at 14:00 UTC, to patch two critical vulnerabilities. Both flaws have received a CVSS v4.0 score of 9.2, indicating a severe risk. As PHP is the underlying programming language for WordPress, every website built on this popular CMS will be affected by these vulnerabilities, regardless of the themes or plugins in use.
The PHP team has not yet disclosed the specific versions of PHP that are vulnerable, the nature of the vulnerabilities themselves, or the exact versions that will contain the fixes. These details are expected to be published concurrently with the release. However, the team has also stated that the release might be expedited if details of either vulnerability become public prematurely or if evidence of active exploitation emerges in the wild.
This upcoming release is distinct from WordPress core updates. PHP is server-side software, typically managed by hosting providers rather than being part of the WordPress installation itself. This means that standard WordPress automatic updates will not apply this critical patch. The responsibility for updating PHP generally falls to the hosting provider for shared and managed hosting environments, while users or their developers must handle updates on VPS or dedicated servers.
Site owners are strongly advised to determine who is responsible for managing PHP updates on their servers. For those using managed or shared hosting, it is crucial to confirm with the provider their plan and timeline for applying the PHP security update. If server administration is handled independently, a maintenance window should be scheduled for shortly after the release time to apply the patch promptly.
Before the update is available, users should verify their current PHP version via the WordPress dashboard under Tools > Site Health > Info > Server. It is recommended to run a supported PHP version, such as PHP 8.5, 8.4, or 8.3, as older versions may not receive security fixes. If a site is running an unsupported version, owners should consult their host about migrating to a supported version and test compatibility thoroughly.
As a precautionary measure, all site owners should perform a full backup of their website files and database before any server-level changes are made. Utilizing a staging site for testing the PHP update before applying it to the live environment is also a best practice. Staying informed through official PHP channels, such as the php.net homepage, is essential for timely updates.
The Wordfence Threat Intelligence team is actively monitoring the situation. Once the PHP team releases the technical details, Wordfence will analyze the vulnerabilities, assess their impact on WordPress sites, and determine the feasibility of providing firewall protection. Regardless of specific findings, updating the server's PHP version remains the most critical step for mitigating these risks.