WordPress, PHP and Node.js stack breach guide
Published 4 Nov 2026 · Updated 2026-11-04
In a WordPress + PHP + Node.js stack you have two runtimes to patch: update WordPress to 7.1.4+, PHP to 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12+, and Node.js to 22.23.4, 24.22.1 or 26.12.1 or later. All three have 2026 vulnerabilities in CISA's Known Exploited Vulnerabilities catalog, and Node.js 20 reached end of life on 30 April 2026.
Who this is for: Businesses and agencies running WordPress as a CMS (often headless via the REST API) with a Node.js front end, API or build pipeline (for example Next.js or Express). Written by our collective of Melbourne web and app developers; facts checked against NVD, the CISA KEV catalog and vendor advisories on 2026-11-04. Free to use and share.
Book a free stack check Already breached? First steps
Supported versions
WordPress
WordPress does not publish fixed end-of-life dates per branch. The project recommends running the latest release (7.1.4 at the time of writing, released 28 October 2026); security fixes are sometimes backported to older branches, but only the current release is fully supported.
| Branch | Active support | Security support until |
|---|---|---|
| 7.1 | Current release (7.1.4) | Supported |
| 7.0 and older | — | Backports only, at the project's discretion |
Source: WordPress official lifecycle (checked 2026-11-04).
PHP
| Branch | Active support | Security support until |
|---|---|---|
| 8.1 and older | — | End of life |
| 8.2 | 2024-12-31 | 2026-12-31 |
| 8.3 | 2025-12-31 | 2027-12-31 |
| 8.4 | 2026-12-31 | 2028-12-31 |
| 8.5 | 2027-12-31 | 2029-12-31 |
Source: PHP official lifecycle (checked 2026-11-04).
Node.js
| Branch | Active support | Security support until |
|---|---|---|
| 20 and older | — | End of life (20.x ended 2026-04-30) |
| 22 (Jod, LTS) | Maintenance since 2025-10-21 | 2027-04-30 |
| 24 (Krypton, LTS) | Maintenance since 2026-10-20 | 2028-04-30 |
| 25 | — | End of life (2026-06-01) |
| 26 (Lithium, LTS) | 2027-10-20 | 2029-04-30 |
Source: Node.js official lifecycle (checked 2026-11-04).
Key high and critical CVEs for this stack
These are recent high or critical vulnerabilities. "KEV" means CISA lists it as known to be exploited in the wild.
| CVE | Component | Affected | Fixed in | CVSS | KEV |
|---|---|---|---|---|---|
| CVE-2026-119977 | WordPress: Upgrade-window race condition (predictable staging paths) allowing unauthenticated code execution | 4.7 through 7.1.3 | 7.1.4 | 8.1 (CVSS 3.1, Wordfence) | Yes (added 2026-11-03) |
| CVE-2026-87902 | WordPress: Page-template resolution local .php file inclusion, can lead to remote code execution | All branches before 4.7.37 … 6.9.9, 7.0.6, 7.1.2 (see NVD for each branch) | 7.1.2 (and branch backports such as 6.9.9, 6.8.10) | 8.1 (CVSS 3.1, CNA) | Yes (added 2026-09-25) |
| CVE-2026-63030 | WordPress: REST API batch endpoint route confusion; chained with CVE-2026-60137 (WP_Query author__not_in SQL injection, CVSS 5.9) for remote code execution | 6.9.x before 6.9.5, 7.0.x before 7.0.2 | 6.9.5, 7.0.2 | 9.8 (CVSS 3.1, WPScan) | Yes (added 2026-07-21) |
| CVE-2026-109618 | PHP: Out-of-memory handling memory corruption leading to unauthenticated remote code execution | 5.x/7.3 up to 8.2.34, 8.3.0–8.3.35, 8.4.0–8.4.26, 8.5.0–8.5.11 (7.3.0+ per NVD) | 8.2.35, 8.3.36, 8.4.27, 8.5.12 | 9.2 (CVSS 4.0, PHP) | Yes (added 2026-10-26) |
| CVE-2026-109619 | PHP: Stale internal request state leading to unauthenticated remote code execution | 5.4.0 up to 8.2.34, 8.3.0–8.3.35, 8.4.0–8.4.26, 8.5.0–8.5.11 | 8.2.35, 8.3.36, 8.4.27, 8.5.12 | 9.2 (CVSS 4.0, PHP) | Yes (added 2026-10-26) |
| CVE-2024-4577 | PHP: PHP-CGI argument injection on Windows (Apache + PHP-CGI, certain code pages) | 8.1 before 8.1.29, 8.2 before 8.2.20, 8.3 before 8.3.8 | 8.1.29, 8.2.20, 8.3.8 | 9.8 (CVSS 3.1, PHP) | Yes (added 2024-06-12) |
| CVE-2026-111497 | Node.js: Brotli decoder out-of-bounds write (bundled Brotli) that may allow remote code execution via a crafted compressed stream | Node.js before 22.23.4, 24.x before 24.22.1, 25.x/26.x before 26.12.1 (and Google Brotli 1.0.3–1.2.0) | 22.23.4, 24.22.1, 26.12.1 | 9.8 (CVSS 3.1, NVD); rated High by Node.js | Yes (added 2026-10-27) |
| CVE-2024-27980 | Node.js: Windows: batch-file argument handling in child_process.spawn allows command injection even without shell option | Node.js on Windows before the April 2024 security releases | April 2024 security releases (those release lines are now end of life; use a supported line) | 8.1 (CVSS 3.0, HackerOne) | Not listed |
How attacks on this stack typically work
- Headless WordPress still exposes the REST API publicly; REST route flaws such as CVE-2026-63030 matter even if nobody visits the WordPress theme.
- Node.js services that decompress untrusted input (HTTP bodies, uploads, proxied responses) are exposed to decoder bugs such as the Brotli flaw CVE-2026-111497.
- Secrets shared between the two halves (application passwords, JWT keys, database credentials in environment files) let an attacker pivot from one runtime to the other.
- End-of-life Node.js versions (20 and older, 25) receive no fixes; Node.js notes that end-of-life versions are always affected when a security release occurs.
Patch and hardening steps
- Find your exact versions. In WordPress, Tools → Site Health → Info shows WordPress and PHP versions; Plugins lists each plugin version. For Node.js run node --version or check your host settings.
- Back up first (files and database), and keep the backup off the server.
- Update WordPress to at least: 7.1.4; 7.1.2 (and branch backports such as 6.9.9, 6.8.10); 6.9.5, 7.0.2. Move off any end-of-life branch.
- Update PHP to at least: 8.2.35, 8.3.36, 8.4.27, 8.5.12; 8.1.29, 8.2.20, 8.3.8. Move off any end-of-life branch.
- Update Node.js to at least: 22.23.4, 24.22.1, 26.12.1; April 2024 security releases (those release lines are now end of life; use a supported line). Move off any end-of-life branch.
- Remove unused plugins, apps, themes and accounts, and turn on automatic updates for minor and security releases where available.
- Lock down admin: unique passwords, multi-factor authentication for every admin, and restrict wp-admin and XML-RPC where possible (WordPress hardening guide).
- Check for signs of compromise after patching a KEV-listed flaw: unknown admin users, unexpected new files on the server, changed checkout or header scripts.
- Follow a patching cadence. The ACSC's Essential Eight treats patching applications as a core mitigation.
What this means for your industry
Healthcare clinics, allied health, legal and accounting practices often run a CMS such as WordPress or Silverstripe for bookings and enquiry forms, which collect sensitive personal information. A compromise can become a notifiable data breach: see data breach help for Australian businesses. Industry-specific guides are coming.
Melbourne or Victorian public-sector supplier? See Melbourne and Victorian breach contacts. We will cover reported incidents involving these technologies in our Australian breach news.
Want a second pair of eyes on your stack?
Book a short call and one of our developers will talk through your versions and patch plan. No pressure, no scare tactics.
Frequently asked questions
Which Node.js versions are supported?
Per the Node.js release schedule, 22.x and 24.x are in maintenance LTS (until 30 Apr 2027 and 30 Apr 2028) and 26.x is the active LTS (until 30 Apr 2029). 20.x and 25.x are end of life. Source
Is headless WordPress safer?
It can reduce exposure of the theme layer, but the WordPress REST API and admin are still online and still need patching. Restrict wp-admin and unused REST routes where you can. Source
How do I check my Node.js version?
Run node --version on the server or check the runtime setting on your hosting platform (for example the Node.js version in your Vercel or other host project settings). Source
Where do Australian businesses get alerts?
Sign up to the ACSC's alerts on cyber.gov.au and follow the vendor security pages for PHP, WordPress and Node.js. Source
Related stack guides
- Drupal and PHP stack breach guide
- Adobe Commerce (Magento) and PHP stack breach guide
- Next.js, React and Node.js stack breach guide
- PHP + WordPress stack breach guide
- Shopify store security guide
- Silverstripe CMS, PHP and jQuery stack breach guide
- Webflow and hosted CMS security guide
- WooCommerce, WordPress and PHP stack breach guide
- All stack security guides
Sources
- api.wordpress.org/core/version-check/1.7/
- nvd.nist.gov/vuln/detail/CVE-2026-119977
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977
- wordpress.org/news/2026/10/wordpress-7-1-4
- nvd.nist.gov/vuln/detail/CVE-2026-87902
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902
- github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp
- nvd.nist.gov/vuln/detail/CVE-2026-63030
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030
- nvd.nist.gov/vuln/detail/CVE-2026-60137
- wordpress.org/news/2026/07/wordpress-7-0-2-release/
- www.php.net/supported-versions.php
- nvd.nist.gov/vuln/detail/CVE-2026-109618
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618
- github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
- www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
- nvd.nist.gov/vuln/detail/CVE-2026-109619
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619
- github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
- nvd.nist.gov/vuln/detail/CVE-2024-4577
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4577
- www.php.net/ChangeLog-8.php
- github.com/nodejs/Release/blob/main/schedule.json
- nvd.nist.gov/vuln/detail/CVE-2026-111497
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497
- nodejs.org/en/blog/vulnerability/october-2026-security-releases
- nvd.nist.gov/vuln/detail/CVE-2024-27980
- nodejs.org/en/blog/vulnerability/april-2024-security-releases-2
- developer.wordpress.org/advanced-administration/security/hardening/
- www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight
General information only, not legal or professional advice. Versions and CVEs change quickly; always confirm against the vendor before acting.