Is WooCommerce Affected by PHP2Shell?

Short answer

WooCommerce runs on PHP, so a WooCommerce site is affected by PHP2Shell if its server runs PHP older than the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12). Updating WooCommerce itself doesn't fix it; your host or developer updates PHP. WooCommerce follows WordPress's requirements, and WordPress recommends PHP 8.3 or greater.

WooCommerce runs on PHP: Yes
newest fixed release: 8.5.12

Is WooCommerce affected by PHP2Shell?

WooCommerce is a WordPress plugin, so a WooCommerce store runs on the same PHP as the WordPress site it lives in. Checkout and payment pages run on that PHP too. PHP2Shell is a flaw in PHP itself, not in WooCommerce, so updating WooCommerce or its plugins doesn't fix it. A WooCommerce site is affected if its server runs PHP from before the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12), released October 21, 2026.

How to see your PHP version in WooCommerce

Log in to your WordPress dashboard.
Open WooCommerce, then Status.
In Server Environment, the PHP version field shows the version your hosting server runs.

Who updates PHP for a WooCommerce site

The same as WordPress: your host on shared or managed hosting, your developer on your own server.

Guides for common hosts: cPanel, SiteGround, Bluehost, WP Engine, Kinsta.

Which PHP version WooCommerce supports

WooCommerce follows WordPress's requirements, and WordPress recommends PHP 8.3 or greater. Whatever the line, use its newest release: for PHP2Shell that means 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later.

What PHP Scanner looks for on a WooCommerce site

PHP Scanner recognizes WooCommerce from a page generator tag naming WooCommerce, WooCommerce session cookies, the usual WordPress signals (a generator tag, an API link, /wp-content/ paths). Many WooCommerce servers hide their PHP version, which is good practice; then your result asks you to paste the version from the steps above for an exact rating.

Questions people ask

Is my WooCommerce site safe from PHP2Shell?

No outside check can promise that. What you can confirm is that its PHP is a fixed release (8.2.35, 8.3.36, 8.4.27, 8.5.12) or newer. If it is, PHP2Shell's fix is in.

Does updating WooCommerce fix PHP2Shell?

No. PHP2Shell is in PHP, which your host or developer updates. Keep WooCommerce updated as well, but it's a separate job.

What PHP version should WooCommerce run?

WooCommerce follows WordPress's requirements, and WordPress recommends PHP 8.3 or greater. Use the newest release of whichever line you're on.

My host says PHP is up to date but the version looks old. Why?

Some hosts and Linux distributions add security fixes without changing the version number. Ask your host to confirm in writing that the PHP2Shell fix is applied.

Sources

Checked against these sources on October 22, 2026. PHP Scanner is a free tool from Catch Digital and is not affiliated with the PHP project.