WordPress runs on PHP, so a WordPress site is affected by PHP2Shell if its server runs PHP older than the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12). Updating WordPress itself doesn't fix it; your host or developer updates PHP. WordPress recommends PHP 8.3 or greater.
- WordPress runs on PHP
- Yes
- newest fixed release
- 8.5.12
Is WordPress affected by PHP2Shell?
WordPress is written in PHP, so every self-hosted WordPress site runs on whatever PHP version its server provides. PHP2Shell is a flaw in PHP itself, not in WordPress, so updating WordPress or its plugins doesn't fix it. A WordPress site is affected if its server runs PHP from before the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12), released October 21, 2026.
How to see your PHP version in WordPress
- Log in to your WordPress dashboard.
- Open Tools, then Site Health.
- Click the Info tab, then open Server.
- The PHP version line shows the exact version.
Who updates PHP for a WordPress site
On shared or managed WordPress hosting, your host provides PHP and applies its security releases; you pick the version in your hosting panel. On a server you run yourself, your developer does.
Guides for common hosts: cPanel, GoDaddy, Bluehost, SiteGround, Hostinger, WP Engine, Kinsta.
Which PHP version WordPress supports
WordPress recommends PHP 8.3 or greater. Whatever the line, use its newest release: for PHP2Shell that means 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later.
What PHP Scanner looks for on a WordPress site
PHP Scanner recognizes WordPress from a page generator tag naming WordPress, a WordPress API link in the page or its headers, WordPress cookies or a pingback header, file paths under /wp-content/. Many WordPress servers hide their PHP version, which is good practice; then your result asks you to paste the version from the steps above for an exact rating.
Questions people ask
Is my WordPress site safe from PHP2Shell?
No outside check can promise that. What you can confirm is that its PHP is a fixed release (8.2.35, 8.3.36, 8.4.27, 8.5.12) or newer. If it is, PHP2Shell's fix is in.
Does updating WordPress fix PHP2Shell?
No. PHP2Shell is in PHP, which your host or developer updates. Keep WordPress updated as well, but it's a separate job.
What PHP version should WordPress run?
WordPress recommends PHP 8.3 or greater. Use the newest release of whichever line you're on.
My host says PHP is up to date but the version looks old. Why?
Some hosts and Linux distributions add security fixes without changing the version number. Ask your host to confirm in writing that the PHP2Shell fix is applied.
Sources
Checked against these sources on October 22, 2026. PHP Scanner is a free tool from Catch Digital and is not affiliated with the PHP project.