PHP vulnerabilities enable code execution on WordPress
Two critical PHP vulnerabilities can expose WordPress sites to remote code execution, meaning an attacker can make the website’s underlying service run commands without first signing in. PHP, the programming language in which WordPress is primarily written, released emergency security updates on October 21, 2026. The flaws, CVE-2026-109618 and CVE-2026-109619, each have a CVSS v4.0 score of 9.2 out of 10. CVSS, or Common Vulnerability Scoring System, is a standard scale for rating security severity.
These are not vulnerabilities in WordPress Core, plugins or themes. They affect the PHP service that processes website traffic, so installing a WordPress update will not fix them. The first corrected PHP releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Linux distributions and long-term-support vendors may place the same fixes into packages that retain older main version numbers. Administrators must therefore check the complete package revision, which identifies the vendor’s precise build, and read its security notice rather than relying on the main PHP version alone.
Both flaws can be exploited without authentication. Successful exploitation gives an attacker the same access that the website itself has. Depending on that access, the attacker could read database credentials, change website files, steal data or install a persistent backdoor, which is hidden access designed to survive after the initial intrusion. PHP has confirmed remote code execution for both vulnerabilities. It also confirmed an attack path for CVE-2026-109618 that operates before WordPress begins running, placing it outside the protection provided solely by controls inside WordPress.
CVE-2026-109618 involves PHP mishandling data when a request makes it run out of memory. The resulting memory corruption can allow an unauthenticated attacker to execute code. CVE-2026-109619 involves stale worker state: a PHP worker, one of the running processes that handles requests, can continue using data from a request that has already finished and should have been discarded. A later request processed by that same worker can use the retained data to run code.
Wordfence Threat Intelligence examined the PHP patches and tested the vulnerable behaviour in PHP and WordPress laboratory environments. In a specially configured Apache lab running PHP 8.5.11, a proof of concept, a test designed to demonstrate that a vulnerability works, exploited CVE-2026-109619 through an HTTP web request and created a temporary text file. That confirmed code execution in the test environment. The same test crashed a normal optimised build of PHP 8.5.11 instead of executing code, while corrected PHP 8.5.12 remained healthy.
For CVE-2026-109618, vulnerable PHP 8.5.11 failed when tested, whereas PHP 8.5.12 processed the same proof-of-concept request normally. Separate tests used WordPress 7.1.3 with an affected Ubuntu PHP 8.5.4 package. Specially prepared requests caused PHP failures or restarts in some configurations, but Wordfence did not independently achieve code execution for this flaw. Testing began within hours of the fixes and was continuing across additional attack paths and common WordPress hosting configurations.
The different results do not make an unpatched system safe. Exploitation may have to be adjusted for a particular server. CrowdStrike reports that its private exploit worked reliably on Intel and AMD systems as well as Arm systems, including against newly restarted PHP workers, although Wordfence did not independently test that unpublished exploit. Public proof-of-concept code and technical commentary are already circulating, but Wordfence cautions that some examples are incomplete, misleading or wrong. Site owners should follow PHP’s official advisories rather than waiting to see whether one public exploit works against their exact server.
PHP 8.1 and older no longer receive releases from the PHP project. Some operating-system and long-term-support vendors may still provide the fixes for those branches. Anyone using an older version should obtain explicit confirmation from the vendor that both vulnerabilities are corrected, or move to a supported PHP branch. After installing a fixed package, PHP must be restarted so every running process loads the new code. A container, an isolated software environment packaged with its dependencies, should be rebuilt and redeployed from an updated image rather than merely restarted with its old files.
WordPress administrators can check the version serving the website under Tools, Site Health, Info, then Server. The command-line check “php -v” is not sufficient by itself because the website can use a different PHP installation. Managed-hosting customers should ask whether the PHP service serving their site is patched for both CVEs and whether it has been restarted. Self-managed operators need to update PHP and restart Apache, PHP-FPM, which is a service that runs PHP for web servers, or any other PHP service. Agencies and hosting providers should inspect public sites, staging copies used for testing, origin addresses reached behind intermediary services, and older containers.
As a precaution, administrators should retain backups and preserve web-server, PHP, firewall and system logs covering at least the 48 hours before the October 21 release through the time PHP was patched and restarted. Sites that were updated late should have those records examined for unusual activity. An absence of obvious suspicious entries does not prove that exploitation did not happen. PHP’s temporary recommendations may reduce exposure to particular attack paths when immediate patching is impossible, but they are incomplete, may disrupt normal website functions and do not replace the update.
Wordfence says its firewall operates at the WordPress application layer and can block WordPress-specific attacks that general-purpose tools may not recognise. These PHP vulnerabilities exist at the server layer, and some exploitation can begin before WordPress starts, so security controls are also needed for PHP, the web server, operating system and network edge, the point where external traffic enters the infrastructure. For readers reviewing where their site runs, AEU Hosting is AEU Group’s managed WordPress hosting service, described as secured end to end.
A fully updated WordPress installation can remain exposed until the PHP service behind it receives both fixes and is restarted. Wordfence says customers of its Care and Response services can contact its incident-response team if they suspect compromise; Wordfence Response states 24-hour, year-round availability and a one-hour response time. The essential action for every affected site remains the same: install a corrected PHP package, restart the service and verify the exact package actually processing website requests.