WordPress and the PHP vulnerability: what you need to do as a site owner
WordPress runs on PHP, so on 21 October 2026 millions of site owners will be asking the same question: is my site vulnerable to the two critical PHP vulnerabilities, and do I need to do anything? The short answer is that most of the work lies with your hosting provider. You can read the longer answer below, including the steps you do need to take yourself.
Your WordPress site runs on PHP and can therefore be affected. The fix is a PHP update on the server, which on standard hosting is installed by your hosting provider. A WordPress or plugin update does not fix this vulnerability.
What you do yourself: look up your PHP version, ask your hosting provider when they will update, and check that everything works after the update. The steps are below.
Why WordPress sites can be affected
- WordPress is written in PHP. So every WordPress site runs on a server with PHP.
- The vulnerability is in PHP itself, not in WordPress, a theme or a plugin.
- With standard and managed hosting, the hosting provider updates PHP, not you.
- If your site runs on a PHP version that is no longer supported, no update will be released for it.
- After the update, test logging in, forms and the webshop, and check the log files.
WordPress is the most widely used CMS in the world. According to W3Techs, 39.6 per cent of all websites run on it, roughly four in ten. All of those sites have one thing in common: WordPress is written in PHP and needs a server with PHP to work. A critical vulnerability in PHP therefore affects not just one plugin or one theme, but the foundation beneath every WordPress site.
That makes this vulnerability different from the WordPress vulnerabilities you may be familiar with. Normally a vulnerability sits in a plugin, and an update in the dashboard fixes it. This time the problem is one layer deeper, in the software on the server. You cannot reach that from the WordPress dashboard.
Who does what: you, your hosting provider or your developer
Who installs the update depends on how your site is hosted. In most cases it is not you. But you are the one who needs to make sure it actually happens.
Who updates PHP, by type of WordPress hosting
| Type of hosting | Who updates PHP | What you do yourself |
|---|---|---|
| Shared hosting with a hosting provider | The hosting provider | Find out when they will update and test afterwards |
| Managed WordPress hosting | The provider | Check that the new version is active |
| Your own VPS or server | You or your hosting management partner | Install the update yourself or have it installed |
| WordPress.com | WordPress.com | Usually nothing, as the service manages the server |
| Site built and managed by an agency | As set out in your maintenance agreement | Ask your agency whether it has been dealt with |
What Dutch hosting providers are saying
Several hosting providers have already communicated what they are doing. The overview below reflects the situation on Wednesday afternoon, according to De Zaak. If your hosting provider is not listed, check its status page or your email.
What hosting providers communicated, as of 21 October at around 1:30pm
| Hosting provider | What they are doing | Do you need to do anything? |
|---|---|---|
| Hostnet | Maintenance from 4pm to 11pm to update PHP | Not according to Hostnet |
| Antagonist | Emergency measure on all servers, PHP will be updated after the release | Test after the update |
| Vimexx | Updates all servers immediately after the release | Only if you have your own, unmanaged server |
| Combell | Has taken measures | Test after the update |
Don't just ask your hosting provider whether they are working on it. Ask which PHP version your site is currently using, when the update will be installed and whether any extra protection is in place until then.
The steps for today
- Look up your PHP version
In the dashboard under Tools, Site Health, the Info tab, Server section. Make a note of the version.
- Make a backup
Of the files and the database, and store it off the server. Many hosting providers offer this in their control panel.
- Ask your hosting provider about their schedule
When will they install the update after the 4pm release, and what are they doing to protect your site until then?
- Update WordPress and plugins too
This does not fix the PHP vulnerability, but a site that is otherwise up to date is less vulnerable and less likely to break when the PHP update is installed.
If you can't find the version in the dashboard, use one of the four ways to find your PHP version. Don't leave a file containing phpinfo() on your site: it shows anyone which version you are running.
If your site runs on an old PHP version
According to the WordPress.org statistics, more than a third of all WordPress sites, 36 per cent, run on PHP 8.1 or older. These versions are no longer supported. This is often because a theme or plugin doesn't work on a newer version and nobody had the time to look into it. As long as the site worked, it didn't seem to be a problem.
With this vulnerability, it does become a problem. A version that is no longer supported won't receive a security update. Your hosting provider therefore can't fix that version, only replace it. In such a case, your hosting provider may move an outdated version to a newer one itself. That protects your site, but can break components that only worked on the old version.
Your site runs on an outdated PHP version. Tick what applies to see the most sensible next step.
Test first
Switch straight away
Tick above what applies to your site.
Test first: 0Switch straight away: 0
After the update: how to check your site
Once the update is installed, check Site Health again to see whether the new version is active. Then test what matters to your visitors: the homepage, the contact form, logging in and, if you have a webshop, an order up to the payment step. If something doesn't work, don't switch back to the old PHP version yourself, but contact your hosting provider or developer.
Finally, check whether anything has changed since the announcement on 20 October that you do not recognise: new users with admin rights, unfamiliar plugins or files, or pages you did not create. If you see anything like this, replace all passwords and bring in a specialist.
For the background, the timeline and which organisations took their sites offline, read the overview of the PHP vulnerability.
Loading the overview.
From an Appfront server, we measure whether the public homepage loads. We do not test logging in with DigiD. A page that only shows a maintenance message does not count as normally reachable. Is your own platform running on PHP and are you unsure? Have a developer take a look.
websites run on WordPress, according to W3Techs measurements.
the severity score out of 10 (CVSS 4.0) of each of the two PHP vulnerabilities.
of WordPress sites run on a PHP version that no longer receives updates, according to WordPress.org.
Frequently asked questions
About WordPress and the PHP vulnerability of October 2026.
Is my WordPress site vulnerable to the PHP vulnerability?
Possibly. WordPress runs on PHP, so any WordPress site can be affected. The PHP security team will announce exactly which PHP versions are vulnerable when the update is released.
Does a WordPress update fix the PHP vulnerability?
No. The vulnerability is in PHP on the server. Updating WordPress, a theme or a plugin does nothing to PHP itself.
Who installs the PHP update for my WordPress site?
With shared and managed hosting, your hosting provider. If you have your own VPS or server, you or your hosting and maintenance provider will do it.
Where can I see my PHP version in WordPress?
Under Tools, Site Health, the Info tab, Server section.
Can the PHP update break my site?
Within the same version, rarely. If your site is moved from an outdated PHP version to a newer one, old plugins or a custom theme can cause problems. So test after the update.
Do I need to change my WordPress password?
Not by default. If you see signs of abuse after the update, such as unfamiliar admins or files, replace all passwords and bring in a specialist.
Further reading
The PHP vulnerability of October 2026
What is going on, which sites are offline and the timeline.
Read more ChecklistHow to check your website
Finding your PHP version and deciding whether to take your site offline.
Read more Web shopCustom WooCommerce web shop development
A WordPress web shop that stays well maintained.
Read morePrefer to have someone else handle this for you?
Appfront builds and maintains websites and platforms, including on WordPress. Want to know whether your site runs on a secure PHP version, or are you looking for a partner who will take care of updates like this from now on? Schedule a conversation with a developer.