Is WordPress safe after PHP2Shell and wp2shell?
Two separate WordPress issues came up in 2026: the PHP2Shell PHP flaw and the wp2shell WordPress-core chain. What they are and how to check your site.
Nikolas Gannon · · 2 min read · Systems and security
WordPress had two serious security issues in 2026. They are easy to mix up, so here is what each one is and what to check. The short answer to the title is yes. WordPress is fine to keep using, as long as it is kept up to date.
Issue 1: PHP2Shell, in the PHP language
PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, is a flaw in PHP itself. It was patched on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. WordPress runs on PHP, so WordPress sites on older PHP versions are affected, along with Drupal, Joomla, Magento and most other PHP applications.
Issue 2: wp2shell, in WordPress core
wp2shell is a separate chain inside WordPress core, disclosed in July 2026. It is fixed in WordPress 6.9.5 and 7.0.2. Versions before 6.9 were not affected by the main flaw. Sites that have not updated since July still need this one.
How to check your WordPress site
- Update WordPress core to the latest version, then every plugin and theme.
- Update PHP to a fixed version. Your host can often do this for you.
- Look through your plugins and themes for anything you did not install.
- Check for PHP files in your web root that changed recently and that you did not create.
- If you have WP-CLI, run
wp core verify-checksums. It flags core files that do not match the official release.
If you find something
Deleting the odd file is usually not enough, because there may be another way back in. Restore from a clean backup, change every password and API key, and remove any admin accounts you do not recognise. If that sounds like a lot, your host or a developer can help.
Other options
A well-maintained WordPress site is a reasonable choice for a lot of businesses. If keeping on top of updates is the part you would rather not do, you can pay for managed WordPress hosting, put someone on a maintenance plan, or move to a static site, which has no PHP or plugins to update. I build static sites and do free audits, so if you want a second opinion on which fits, get in touch.
Free resource: Website security check
Free resource: Website health check
Read next: PHP2Shell: critical PHP vulnerability patched October 2026 · Why PHP sites are being targeted in 2026 · Moving off PHP: your static site checklist
Questions
Is WordPress safe to keep using?
Yes, if it is kept updated. Both issues have patches. The sites at risk are the ones that have not applied them.
What is wp2shell?
wp2shell is a critical chain in WordPress core, disclosed in July 2026 and fixed in WordPress 6.9.5 and 7.0.2. Unpatched, it allows a site takeover without a login.
How do I check my WordPress site?
Update WordPress core, plugins and PHP, then look for unfamiliar users, plugins and recently changed files. The checks are in this post.