PHP + WordPress stack breach guide
Published 4 Nov 2026 · Updated 2026-11-04
If your website runs WordPress on PHP, update WordPress to 7.1.4 or later and PHP to a patched supported release (8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later) now. Both have vulnerabilities that CISA lists as actively exploited in 2026, several allowing an attacker to run code on your server without logging in.
Who this is for: Australian small businesses, clinics, professional services and agencies running a WordPress site on PHP hosting. Written by our collective of Melbourne web and app developers; facts checked against NVD, the CISA KEV catalog and vendor advisories on 2026-11-04. Free to use and share.
Book a free stack check Already breached? First steps
Supported versions
PHP
| Branch | Active support | Security support until |
|---|---|---|
| 8.1 and older | — | End of life |
| 8.2 | 2024-12-31 | 2026-12-31 |
| 8.3 | 2025-12-31 | 2027-12-31 |
| 8.4 | 2026-12-31 | 2028-12-31 |
| 8.5 | 2027-12-31 | 2029-12-31 |
Source: PHP official lifecycle (checked 2026-11-04).
WordPress
WordPress does not publish fixed end-of-life dates per branch. The project recommends running the latest release (7.1.4 at the time of writing, released 28 October 2026); security fixes are sometimes backported to older branches, but only the current release is fully supported.
| Branch | Active support | Security support until |
|---|---|---|
| 7.1 | Current release (7.1.4) | Supported |
| 7.0 and older | — | Backports only, at the project's discretion |
Source: WordPress official lifecycle (checked 2026-11-04).
Key high and critical CVEs for this stack
These are recent high or critical vulnerabilities. "KEV" means CISA lists it as known to be exploited in the wild.
| CVE | Component | Affected | Fixed in | CVSS | KEV |
|---|---|---|---|---|---|
| CVE-2026-109618 | PHP: Out-of-memory handling memory corruption leading to unauthenticated remote code execution | 5.x/7.3 up to 8.2.34, 8.3.0–8.3.35, 8.4.0–8.4.26, 8.5.0–8.5.11 (7.3.0+ per NVD) | 8.2.35, 8.3.36, 8.4.27, 8.5.12 | 9.2 (CVSS 4.0, PHP) | Yes (added 2026-10-26) |
| CVE-2026-109619 | PHP: Stale internal request state leading to unauthenticated remote code execution | 5.4.0 up to 8.2.34, 8.3.0–8.3.35, 8.4.0–8.4.26, 8.5.0–8.5.11 | 8.2.35, 8.3.36, 8.4.27, 8.5.12 | 9.2 (CVSS 4.0, PHP) | Yes (added 2026-10-26) |
| CVE-2024-4577 | PHP: PHP-CGI argument injection on Windows (Apache + PHP-CGI, certain code pages) | 8.1 before 8.1.29, 8.2 before 8.2.20, 8.3 before 8.3.8 | 8.1.29, 8.2.20, 8.3.8 | 9.8 (CVSS 3.1, PHP) | Yes (added 2024-06-12) |
| CVE-2026-119977 | WordPress: Upgrade-window race condition (predictable staging paths) allowing unauthenticated code execution | 4.7 through 7.1.3 | 7.1.4 | 8.1 (CVSS 3.1, Wordfence) | Yes (added 2026-11-03) |
| CVE-2026-87902 | WordPress: Page-template resolution local .php file inclusion, can lead to remote code execution | All branches before 4.7.37 … 6.9.9, 7.0.6, 7.1.2 (see NVD for each branch) | 7.1.2 (and branch backports such as 6.9.9, 6.8.10) | 8.1 (CVSS 3.1, CNA) | Yes (added 2026-09-25) |
| CVE-2026-63030 | WordPress: REST API batch endpoint route confusion; chained with CVE-2026-60137 (WP_Query author__not_in SQL injection, CVSS 5.9) for remote code execution | 6.9.x before 6.9.5, 7.0.x before 7.0.2 | 6.9.5, 7.0.2 | 9.8 (CVSS 3.1, WPScan) | Yes (added 2026-07-21) |
How attacks on this stack typically work
- Automated bots scan the internet for WordPress sites and read the version from public signals, then try known exploits within hours of a patch (Patchstack reported probing hours after the CVE-2026-87902 fix).
- Unauthenticated remote code execution in PHP or WordPress core gives the attacker a web shell: they then add admin users, inject spam or card-skimming scripts, or copy the database.
- Vulnerable plugins and themes are the most common entry point; core flaws such as CVE-2026-60137 become exploitable when a plugin passes untrusted input to core functions.
- Stolen or reused admin passwords and exposed wp-login.php / XML-RPC endpoints are brute-forced.
Patch and hardening steps
- Find your exact versions. In WordPress, Tools → Site Health → Info shows WordPress and PHP versions; Plugins lists each plugin version.
- Back up first (files and database), and keep the backup off the server.
- Update PHP to at least: 8.2.35, 8.3.36, 8.4.27, 8.5.12; 8.1.29, 8.2.20, 8.3.8. Move off any end-of-life branch.
- Update WordPress to at least: 7.1.4; 7.1.2 (and branch backports such as 6.9.9, 6.8.10); 6.9.5, 7.0.2. Move off any end-of-life branch.
- Remove unused plugins, apps, themes and accounts, and turn on automatic updates for minor and security releases where available.
- Lock down admin: unique passwords, multi-factor authentication for every admin, and restrict wp-admin and XML-RPC where possible (WordPress hardening guide).
- Check for signs of compromise after patching a KEV-listed flaw: unknown admin users, unexpected new files on the server, changed checkout or header scripts.
- Follow a patching cadence. The ACSC's Essential Eight treats patching applications as a core mitigation.
What this means for your industry
Healthcare clinics, allied health, legal and accounting practices often run a CMS such as WordPress or Silverstripe for bookings and enquiry forms, which collect sensitive personal information. A compromise can become a notifiable data breach: see data breach help for Australian businesses. Industry-specific guides are coming.
Melbourne or Victorian public-sector supplier? See Melbourne and Victorian breach contacts. We will cover reported incidents involving these technologies in our Australian breach news.
Want a second pair of eyes on your stack?
Book a short call and one of our developers will talk through your versions and patch plan. No pressure, no scare tactics.
Frequently asked questions
Which PHP versions are still supported?
According to php.net, PHP 8.2 and 8.3 receive security fixes only (until 31 Dec 2026 and 31 Dec 2027), and 8.4 and 8.5 are actively supported. PHP 8.1 and older are end of life. Source
Is my WordPress site affected by CVE-2026-119977?
NVD lists WordPress 4.7 through 7.1.3 as affected. WordPress 7.1.4 (28 October 2026) fixes it. CISA added it to the Known Exploited Vulnerabilities catalog on 3 November 2026. Source
Does my host patch PHP for me?
On managed WordPress hosting, usually yes, but on shared or self-managed servers you or your developer may need to change the PHP version in the control panel. Check the exact version in Tools → Site Health → Info → Server. Source
I think my site was already compromised. What first?
Contain it (take it offline or into maintenance, reset passwords), keep logs, report to the ACSC on 1300 CYBER1, and assess whether personal information was involved for the Notifiable Data Breaches scheme. Source
Related stack guides
- Drupal and PHP stack breach guide
- Adobe Commerce (Magento) and PHP stack breach guide
- Next.js, React and Node.js stack breach guide
- Shopify store security guide
- Silverstripe CMS, PHP and jQuery stack breach guide
- Webflow and hosted CMS security guide
- WordPress, PHP and Node.js stack breach guide
- WooCommerce, WordPress and PHP stack breach guide
- All stack security guides
Sources
- www.php.net/supported-versions.php
- nvd.nist.gov/vuln/detail/CVE-2026-109618
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618
- github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
- www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
- nvd.nist.gov/vuln/detail/CVE-2026-109619
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619
- github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
- nvd.nist.gov/vuln/detail/CVE-2024-4577
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4577
- www.php.net/ChangeLog-8.php
- api.wordpress.org/core/version-check/1.7/
- nvd.nist.gov/vuln/detail/CVE-2026-119977
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977
- wordpress.org/news/2026/10/wordpress-7-1-4
- nvd.nist.gov/vuln/detail/CVE-2026-87902
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902
- github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp
- nvd.nist.gov/vuln/detail/CVE-2026-63030
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030
- nvd.nist.gov/vuln/detail/CVE-2026-60137
- wordpress.org/news/2026/07/wordpress-7-0-2-release/
- patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/
- developer.wordpress.org/advanced-administration/security/hardening/
- www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight
General information only, not legal or professional advice. Versions and CVEs change quickly; always confirm against the vendor before acting.