Most WooCommerce store owners follow a simple routine: update WordPress, update WooCommerce, update every plugin, and move on. While this helps keep a store secure, it does not cover every risk. PHP, the programming language that powers WordPress and WooCommerce, can also have security vulnerabilities. Two recently reported critical PHP vulnerabilities could allow attackers to execute malicious code on affected servers without authentication.
This guide explains these vulnerabilities, which PHP versions include the security fixes, and how to update your PHP version to protect your WooCommerce store.
On This Page
- What Is the PHP2Shell Vulnerability?
- Which PHP Versions Are Patched?
- How to Protect Your WooCommerce Store
- Signs Your Store May Have Been Exposed
- Conclusion
What Is the PHP2Shell Vulnerability?
On October 21, 2026, the PHP project released security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell. Both vulnerabilities could allow attackers to execute malicious code on affected servers without logging in. This is known as remote code execution (RCE).
Both vulnerabilities affect PHP itself, rather than a specific plugin, theme, or content management system.
How Do These Vulnerabilities Work?
The two vulnerabilities involve different issues in how PHP handles requests:
- CVE-2026-109618: An issue with out-of-memory handling can leave request data partially initialised.
- CVE-2026-109619: Leftover request state may be reused by a later request handled by the same worker.
An attacker could exploit these weaknesses by sending a specially crafted web request to a vulnerable server. Successful exploitation could allow them to execute their own code on that server.
Why It Matters for WooCommerce Stores
WordPress and WooCommerce rely on PHP to run, as do plugins used for shipping, payments, bookings, and order management. A vulnerability in PHP can put the entire store at risk, even when its plugins are up to date.
For WooCommerce store owners, the risks include:
- Customer data exposure: Attackers could access customer addresses, order details, and other information stored on the server.
- Compromised shipping credentials: Carrier API credentials saved in plugin settings could be exposed.
- Shipping and checkout disruptions: A compromised server could interfere with checkout, live shipping rates, label generation, and tracking.
- Wider website compromise: Attackers could modify website files or misuse server resources, depending on the access they gain.
If your store uses shipping or booking solutions such as WooCommerce shipping plugins or WooCommerce booking plugins, these also run within your store’s PHP environment. The vulnerability affects PHP itself, not these plugins, so updating plugins alone will not resolve it.
Contact your hosting provider to confirm that your store is running a patched PHP version. Updating WordPress, WooCommerce, and plugins remains important, but you must also secure the underlying PHP runtime.
Which PHP Versions Are Patched?
Any release below the fixed number on its branch is affected. That means PHP 8.2.34 is vulnerable, while PHP 8.2.35 is patched.
| PHP Branch | Patched Version | What It Means |
|---|---|---|
| PHP 8.5 | 8.5.12 | Update to this version or newer |
| PHP 8.4 | 8.4.27 | Update to this version or newer |
| PHP 8.3 | 8.3.36 | Update to this version or newer |
| PHP 8.2 | 8.2.35 | Patched, but security support ends December 31, 2026 |
| PHP 8.1 and older | No standard release | Upgrade, or ask your host for a backported package |
PHP did publish minimal source backports for 7.4, 8.0, and 8.1, but no official releases, so older sites depend on their host or a long-term support vendor. Linux distributions received the patches early, so your host’s package may carry the fix under an older-looking version label. That is why confirming with your host matters.
Note the PHP 8.2 end-of-life date. Even a patched 8.2 site should plan its next upgrade, and WooCommerce itself recommends PHP 8.3 or newer, with WooCommerce 11.6 requiring at least PHP 8.1.
How to Protect Your WooCommerce Store
Protection comes down to three actions: understand why plugins cannot solve this, find out which PHP version you run, and update it through your host.
Why Plugin Updates Cannot Fix PHP Vulnerabilities
Think of your store as three layers. At the top sit WordPress, WooCommerce, and your plugins. In the middle sits the PHP runtime that executes their code. At the bottom sits the server that hosts everything. Updating a plugin changes only the top layer, so a fully updated store can still run unpatched PHP.
Keep updating plugins, but treat PHP as a separate job.
How to Check Your PHP Version in WordPress
You can check your PHP version in WordPress in under a minute:
- In your WordPress admin, go to WooCommerce > Status and find PHP version under Server environment.
- Alternatively, open Tools > Site Health > Info > Server.
Compare the number with the patched table above. If the version looks old, ask your host whether the security fix was backported, since the label may not change. Check the live site, not a local setup, and repeat the check on staging too.
How to Update Your PHP Version
The method to update the PHP version in WordPress depends on where you host. Most stores should target PHP 8.3 or 8.4.
| Hosting Type | How to Update PHP |
|---|---|
| Shared hosting (cPanel) | Open MultiPHP Manager or PHP Selector, then pick a patched version. This is how you update the PHP version in cPanel. |
| Managed WordPress host | Use the PHP setting in the host dashboard, or ask support to confirm the patch is applied. |
| VPS or cloud server | Upgrade the PHP package, then restart PHP-FPM or the web server so the new version loads. |
| Containers or app platforms | Rebuild the image with patched PHP and redeploy. Restoring an old backup brings the old PHP back. |
Before switching, take a full backup and test on staging. After switching, recheck WooCommerce > Status, then run a test order covering checkout, live shipping rates, and label generation. Those are the flows where a PHP change would show up first.
Signs Your Store May Have Been Exposed
If your site ran an unpatched PHP version after October 21, 2026, look for these warning signs:
- Unknown administrator accounts or unexpected plugin installs.
- Unfamiliar PHP files in the uploads folder.
- Sudden traffic spikes, slow pages, or unexplained scheduled tasks.
If anything looks odd, ask your host to scan the site and check the server logs. Then rotate passwords and API keys, including carrier credentials, and confirm PHP workers were restarted after patching.
Conclusion
This PHP vulnerability is serious, but the fix is simple: confirm your PHP version, update it with your host, and test your key store flows. Plugin updates stay important, yet they cannot patch the layer below them. Spend ten minutes on it today, and your store, your customers’ data, and your shipping setup stay protected.
