PHP2Shell: a critical PHP vulnerability threatens WordPress websites

In short

This week, the most dangerous vulnerability for WordPress websites is in PHP, not in a plugin. Two critical flaws called PHP2Shell let an attacker run their own code on the server without logging in. SI-CERT has issued an alert about them, and exploitation attempts were detected on the very day the patches were released. Vulnerabilities were also published in several popular plugins, including Prime Mover, Popup Builder, User Profile Builder and ACF: Extended. Check the PHP version with your hosting provider and update your plugins.

PHP2Shell: a critical PHP vulnerability that threatens every WordPress website

WordPress is written in the PHP programming language, so every WordPress website runs on a server with PHP. On 21 October 2026, the PHP project released urgent security patches for two critical vulnerabilities. Researchers named them PHP2Shell, and SI-CERT published alert SI-CERT 2026-07 about them.

What’s affected	PHP itself (not WordPress, a theme or a plugin), practically all versions from PHP 5 onwards
Identifiers	CVE-2026-109618 and CVE-2026-109619
Severity	Critical, CVSS 9.2 (CVSS v4.0)
Fixed versions	PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35
Attack status	Exploitation attempts were detected on the day the patches were released

What an attacker can do

Run their own code on the server, without logging in and without a vulnerable plugin. The flaw is in PHP itself, so even a very simple, correctly written website can be vulnerable.
Read part of the server’s memory, which may contain passwords, keys or session cookies.
Researchers at Wiz also demonstrated an unauthenticated attack on a standard WordPress installation.

Why updating WordPress doesn’t help this time

WordPress.org has said that a WordPress update isn’t needed or planned for this issue. It’s PHP on the server that needs fixing, which is usually your hosting provider’s job. Check your PHP version in the WordPress admin under Tools → Site Health → Info → Server.

Recommendation

If your PHP version is lower than the fixed versions listed, contact your hosting provider straight away and ask for an update.
PHP 8.1 and older no longer get official patches from the PHP project. They can only be fixed through your provider (a backported patch) or by upgrading. We recommend PHP 8.4 or 8.5, as support for PHP 8.2 ends on 31 December 2026.
Don’t install unofficial plugins or code that promise a “fix” for PHP2Shell. The only complete solution is updating PHP.
If you can’t update straight away, SI-CERT recommends taking the web application off the public network or another measure that prevents exploitation (e.g. WAF firewall rules with your provider). Some php.ini settings (e.g. session.upload_progress.enabled) only make attacks harder; they don’t prevent them.

This week’s vulnerable WordPress plugins

Between 22 and 24 October 2026, several vulnerabilities in WordPress plugins were published in public CVE databases. Below are the most serious ones or those affecting the most websites. By 24 October, there were no reports of attacks in the wild for any of them, but attacks often start soon after publication.

Prime Mover – critical vulnerability (CVSS 9.8)

Affected: the Prime Mover backup and migration plugin, versions up to and including 2.2.1 (more than 10,000 installations).
Identifier: CVE-2026-115806, critical (9.8 as rated by Wordfence).
What an attacker can do: without logging in, plant specially crafted data in an ordinary comment. When an administrator later exports or restores the website, the plugin processes this data without checking it (PHP Object Injection), which can lead to a website takeover.
Fix: update to version 2.2.2 or later.

GTM Server Side by Stape – order data exposure (CVSS 8.7)

Affected: the GTM Server Side plugin (now Stape Conversion Tracking), versions from 2.0.0 to before 2.1.48 (more than 10,000 installations). It affects WooCommerce online stores.
Identifier: CVE-2026-55826, CVSS 8.7 (CVSS v4.0).
What can happen: another customer’s order details, including personal data, can be written into the page code (dataLayer) without logging in. This is also a data protection risk.
Fix: update to 2.1.48 or later (the current version is 2.3.10).

Affected: the Popup Builder plugin, versions before 4.4.6 (more than 200,000 installations).
Identifier: CVE-2026-112230.
What an attacker can do: without logging in, move popups to the bin and overwrite their preview data.
Fix: update to 4.4.6 or later and check whether the bin contains popups you didn’t delete yourself.

User Profile Builder – four vulnerabilities

Affected: the User Profile Builder plugin, versions before 4.0.5 (more than 40,000 installations).
Identifiers: CVE-2026-111965, CVE-2026-111966, CVE-2026-111982 and CVE-2026-115807.
What an attacker can do: among other things, a user with the Author role can create an account with the higher Editor role (CVSS 7.1 as rated by Wordfence).
Fix: version 4.0.5 fixes all four flaws. After updating, check under Users for unknown accounts or higher roles.

ACF: Extended – shortcode execution in forms

Affected: the ACF: Extended plugin (and PRO), versions from 0.9.2.4 to before 0.9.2.8 (more than 100,000 installations).
Identifier: CVE-2026-94263, medium severity (CVSS 4.8 as rated by WPScan).
What can happen: when submitting a form on the website, a visitor can trigger shortcode execution in the confirmation message. It only affects some forms.
Fix: update to 0.9.2.8 or later.

Front End Users – no fix available, remove the plugin

Affected: the Front End Users plugin, all versions up to and including 3.2.35.
Identifier: CVE-2026-87835, CVSS 6.5.
What an attacker can do: when registering through a form on the website, assign themselves a membership level and mark their account as approved, confirmed and paid.
Fix: not available; the plugin was removed from WordPress.org on 13 October 2026. Remove or replace it and check registered accounts.

What WordPress website owners should do: a security checklist

Check your PHP version (Tools → Site Health → Info → Server). If it isn’t patched, contact your host straight away.
Update all plugins under Dashboard → Updates, especially those listed above.
Remove plugins with no fix (Front End Users) and plugins you don’t use.
Review user accounts: unknown administrators or editors may be a sign of a hack.
Make a backup before updating and check that you know how to restore it.

You’ll find more guides to editing and maintenance in the WordPress support section.

Need help with WordPress updates or security? We’ll check your PHP version, update your plugins and review your website for signs of a hack. Email us at podpora@qstom.si.

Sources

FAQ

Is my WordPress website vulnerable to PHP2Shell?

It is if the server runs PHP older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or PHP 8.1 or older without a patch from your provider. You can see the version under Tools → Site Health → Info → Server.

Is it enough to update WordPress and plugins?

Not for PHP2Shell. The flaw is in PHP on the server, so your hosting provider or server administrator has to fix it. Plugin updates are still essential because of the other vulnerabilities in this roundup.

What should I do if I use the Front End Users plugin?

There's no fix and the plugin has been removed from WordPress.org. Remove it or replace it with another solution, and review registered users and their membership levels.

How can I tell if my website has already been attacked?

Warning signs are unknown administrator accounts, unknown PHP files in the uploads folder, unusual redirects and recurring 500 errors. If you notice any of these, change your passwords and contact us.

Does qStom update PHP and plugins for clients?

Yes. If you need help with updates or a security review, email podpora@qstom.si.

← All guides

Security alerts

Need help?

Didn't find an answer?

Email or call us and we'll be happy to help.

Email: info@qstom.si

Phone: +386 41 678 701

Contact us →