WordPress websites at risk from severe PHP flaws

Three serious holes in WordPress this year let strangers run code on a web server without a password. Here is what happened, who is exposed, and what to do this week.

Japan's prime minister tells sites to patch PHP tonight

On the evening of 21 October, Japan's prime minister, Sanae Takaichi, posted an unusual public warning on X. Critical flaws had been found in PHP itself, and she asked everyone to take action that night. Her advice to organisations: check whether your public-facing sites run PHP, be ready to apply the fix the moment it lands, and if you cannot patch quickly, consider temporarily suspending the website. One report says her post drew more than 23 million views within hours.

The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and are described as problems in how PHP's core handles memory and errors. Reports say they allow remote code execution. One report lists the fixed releases as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Japanese cloud provider Sakura Internet said it was suspending some functions of its service while it dealt with them. An account posting as the FBI's cyber division gave similar advice, though one outlet could not confirm that the account is official.

Why this matters for WordPress. WordPress runs on PHP, so a hole in PHP sits underneath every WordPress site, whatever version of WordPress it runs. Updating WordPress will not fix it. Your host usually controls the PHP version, so ask them which one your site uses and when it moves to a fixed release. This is separate from the WordPress core bugs below, so a site needs both layers current. Details are still settling, so check the official PHP announcement before you act.

The tell-tale sign of a webshell: a PHP file nobody remembers adding.

In July 2026 a researcher at Searchlight Cyber, Adam Kues, showed that an ordinary WordPress site could be taken over by a total stranger. No password was needed. No plugin had to be installed. Nobody on the team had to open a bad email or click a bad link. The attack got a nickname, wp2shell, and a working proof-of-concept soon appeared on GitHub.

If you run a website, work for someone who does, or are the person who "looks after the company blog", this is about you. One national response team puts WordPress at more than 500 million sites worldwide. That is a very large target, and attackers keep coming back because one working trick opens thousands of doors at once.

Why a PHP flaw is worse than it sounds

WordPress is written in PHP, the language that runs on the web server and builds each page when a visitor arrives. A bug in that code which lets an outsider run their own PHP is about as bad as web security gets. The professional term is remote code execution. In plain words, the stranger now works at your company and has the keys.

From there an attacker can read your customer data, send spam from your domain, plant pages that only search engines see, or just sit quietly and wait. The usual tool is a webshell, a tiny PHP file that works as a remote control. In the wp2shell attacks, responders found two. One was a bare one-line backdoor. The other was dressed up as a plugin called CMSmap so it would look like a normal part of the site.

The damage is rarely instant. A hacked site often looks normal for weeks. Customers notice nothing, until a search engine flags the domain or the host suspends it for sending spam. By then the cleanup costs far more than the update would have: staff time, lost orders, and awkward emails to customers about their data.

The real case, step by step

wp2shell is two bugs working as a team.

CVE-2026-60137 is an SQL injection in a setting called author__not_in, deep inside WordPress's own query code. On its own it is rated medium (5.9). It lets an outsider tamper with the questions the site asks its database.
CVE-2026-63030 is a mix-up in how the REST API batch endpoint, /wp-json/batch/v1, routes requests. It is rated 9.8 out of 10. It turns the first bug into code execution.

Chained together, an anonymous visitor can drop PHP files onto the server. Full code execution hit WordPress 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1. Versions 6.8.0 to 6.8.5 had the database half only.

WordPress shipped emergency fixes on 18 July: 6.9.5, 7.0.2 and 6.8.6. It also forced automatic updates on. Even so, Canada's CanSSOC reported on 24 July that several attackers were already succeeding, mainly against self-hosted WordPress running in the cloud. Sites with auto-updates switched off, or hosts that hold updates back, stayed exposed.

Each flaw followed the same path: disclosure, a public exploit, then attacks

It did not stop in July

Patching one hole did not end the season.

In August, Nigeria's NITDA warned about CVE-2026-64638, a flaw on the WordPress login screen that could lead to PHP code execution. Its advice was to update to 7.0.3.
On 24 September, Singapore's Cyber Security Agency flagged CVE-2026-87902, a local file inclusion bug scored 8.1. It lets an unauthenticated visitor trick WordPress into loading a PHP file it should not. On some server and theme setups that becomes code execution. It affects versions before 7.1.2, a public exploit exists, and attacks are under way.
Plugins add more. Security news sites have run critical-bug stories on Elementor Pro, Forminator Forms (about 600,000 sites) and the Avada builder (over a million sites).

The pattern matters more than any single number. A flaw goes public, attackers start within hours, and the people who lose are the ones who have not applied a free update. Kaspersky's analysts made the same point about CVE-2026-87902: only a few hours pass between disclosure and the first attacks.

Who should care

You do not need to be a developer.

Small business owners. Your shop or booking site holds customer details, which makes it worth attacking.
Marketers and agencies. You probably hold the admin login. If a client's site is hacked, your name is on the invoice.
Freelancers and IT generalists. A dozen sites on a dozen update schedules is exactly where one gets missed.
Everyone else. A hacked company site can send mail that looks like it came from you.

Small sites get hit too

It is tempting to think attackers only care about big brands. They do not pick targets by hand. Scanners sweep the internet around the clock, asking every server which WordPress version it runs, and once a public exploit exists they try it on everything that answers. A five-page bakery site and a national newspaper look identical to that machine. All that matters is whether the version number is old.

That is why the first hours count. The gap between a fix being released and your site being updated is exactly the gap the scanners are waiting for.

What to do this week

Four checks that cover most of the risk.

Check your version. In the WordPress dashboard open Dashboard, then Updates, and install the newest release. The September advisories point to 7.1.2 or later.
Switch on automatic updates for core, plugins and themes. Ask your host whether they hold updates back.
Delete what you do not use. Inactive plugins and themes still sit on the server.
Look for strangers. Unfamiliar PHP files in the uploads folder, plugins you never installed, admin users nobody recognises. If you are unsure how, ask your host or developer for a malware scan.
If you cannot update today, ask your host or firewall provider to block /wp-json/batch/v1. That is a stopgap for wp2shell, not a cure.
Keep a recent backup off the server, and try restoring it once so you know it works.

One warning. Updating closes the door. It does not remove anyone already inside. If your site ran an affected version in July or later and was never checked, treat it as possibly compromised. Scan it, change every password and key, and restore from a clean backup if anything odd turns up.

The boring answer works

Nothing here needs special skill. The fixes were free, the update path was clear, and in July WordPress even pushed the update out on people's behalf. The sites most exposed were the ones where updates had been switched off or delayed. Put ten minutes in your calendar this week and make sure you are the person who checks.