Blog / News
PHP2Shell and WordPress 7.1.4: what WooCommerce stores should do now
Two security releases landed in the same week, and both affect every WooCommerce store. On October 21, 2026, the PHP project fixed two critical flaws, nicknamed PHP2Shell, that let an attacker run code on a web server without logging in. Five days later the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed they were being exploited. On October 28, WordPress shipped 7.1.4, a security release with more than a dozen fixes.
The short version: PHP2Shell is fixed on your server, not in your WordPress dashboard, so confirm your host has updated PHP. Then update WordPress, WooCommerce and your extensions, and put your PHP version on the calendar, because it matters again on December 31 and in February.
What happened, day by day
The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619. PHP describes both as memory-safety bugs in how it handles requests: one in out-of-memory handling, one in internal state that outlives the memory behind it. Either can let an unauthenticated request run code on the server. CISA added both to its Known Exploited Vulnerabilities catalog on October 26, which it does only when there is evidence of attacks in the wild.
Is your store exposed to PHP2Shell?
If your server runs a PHP version older than the fixed releases, yes. The bugs are in PHP itself, the language WordPress and WooCommerce run on, so a store with perfectly updated plugins is still exposed. PHP says every installation that serves web requests is at risk (PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed) and rates mod_php highest, because a working attack there runs before any application code.
WooCommerce’s advisory is clear on the part store owners ask about most: no WooCommerce or WordPress update is required or planned for these two issues. The fix is a PHP update, made by your host or whoever runs your server.
| Your PHP branch | Fixed in | Security fixes until |
|---|---|---|
| 8.5 | 8.5.12 | December 31, 2029 |
| 8.4 | 8.4.27 | December 31, 2028 |
| 8.3 | 8.3.36 | December 31, 2027 |
| 8.2 | 8.2.35 | December 31, 2026 |
| 8.1 or older | No release from the PHP project | Already ended |
To check yours, go to Tools → Site Health → Info → Server in WordPress, or WooCommerce → Status → Server environment. The version has to be at or above the fixed release for its branch, so 8.3.35 is exposed and 8.3.36 is not.
Then ask your host two questions: is the fixed PHP build installed, and have the PHP processes been restarted onto it? A patched package doesn’t protect requests until the workers serving your site are running it. Stores on Automattic’s infrastructure (WordPress.com, WordPress VIP, Pressable and WP Cloud) are already protected, according to WooCommerce.
Running your own server and can’t update today? PHP lists settings that reduce exposure to specific attack paths, but says only an update is a complete fix. WooCommerce passes on the UK National Cyber Security Centre’s advice: if you can’t fix it right away, consider taking the site offline until you can.
Update WordPress to 7.1.4
WordPress 7.1.4 is a separate security release, and it’s worth installing the same day. WordPress counts 22 vulnerabilities across 17 advisories, according to Patchstack’s analysis. The fixes include a weakness in the WordPress upgrade process that could lead to remote code execution during the upgrade window, a long list of stored cross-site scripting issues in blocks and the Customizer, a denial-of-service issue in the Interactivity API, and a bug that let unauthenticated visitors discover unpublished Customizer changesets.
Sites with automatic background updates enabled get it on their own. Check that yours did under Dashboard → Updates. The fixes were backported the same day to older branches, down to 4.7.39, but only the latest version is actively supported. WordPress 7.2 is planned for December 8.
Check this year’s other WooCommerce patches
A security week is a good moment to confirm you didn’t miss an earlier one. These are the 2026 advisories from the WooCommerce developer blog that most stores need:
| Date | What | Make sure you run |
|---|---|---|
| March 2 | Store API vulnerability in WooCommerce 5.4 to 10.5.2 that could let an attacker create admin accounts if a signed-in admin opened a malicious link | The patched release for your branch, such as 10.5.3 |
| August 5 | WooCommerce Subscriptions: several issues, the most serious allowing site takeover | Subscriptions 9.1.0 or later |
| August 6 | Stripe for WooCommerce: versions 9.7.0 to 10.8.4 affected | 10.8.5, or the patched build for your release line |
| August 10 | WooCommerce 11.0.1, flagged as a security update | 11.0.1 or later |
Auto-updates don’t always arrive. WooCommerce’s Subscriptions advisory asks you to confirm the installed version on every production and staging site, and to make sure old staging copies aren’t publicly reachable and unpatched.
Your PHP version matters twice more this winter
Patching PHP2Shell fixes this week. Two dates are coming that affect which PHP version you should be on at all.
- December 31, 2026: PHP 8.2 stops receiving security fixes. After that, a store on 8.2 is in the same position 8.1 stores are in today.
- February 2027: WooCommerce 11.6 will require PHP 8.1 or newer. WooCommerce 11.3, due in November, shows a dismissible notice to stores still on PHP 7.4 or 8.0. WooCommerce recommends PHP 8.3 or newer.
If you’re on 8.2, plan the move to 8.3 or 8.4 now: test it on a staging copy (checkout and payment methods, shipping and tax, emails, scheduled jobs, your theme and extensions), then switch in a quiet week. Changing PHP the week of Black Friday is a risk most stores don’t need to take, so early December or the first week of January is a sensible window.
A 15-minute check for this week
- Read your PHP version in Site Health and compare it with the table above.
- Ask your host whether the fixed PHP build is installed and the PHP processes restarted. Get the answer in writing if you’re on a contract.
- Update WordPress to 7.1.4, then WooCommerce and every extension, starting with payment gateways and WooCommerce Subscriptions.
- Look at your users list for admin accounts you don’t recognize, and turn on two-factor sign-in for every admin.
- Find forgotten copies: staging sites, old subdomains and test installs are often the unpatched ones.
- Delete plugins you don’t use. Deactivated plugins are still files on the server.
- Check your backups restore, and keep one copy away from the server.
If you think a store was compromised, WooCommerce’s guidance is to audit logs and files, review admin accounts, remove suspicious files, reset passwords and rotate API keys.
Fewer plugins, fewer things to patch
Every plugin is code on your server that someone has to keep patched, which is one more reason growing stores look hard at how many plugins they run after checkout. OrderCtrl was built to take that work out of WordPress. It runs on its own servers and talks to WooCommerce through the WooCommerce API and webhooks, so tracking, the customer portal, claims and returns, emails and analytics don’t install any code in WordPress.
That plugin got its own update on October 28. Version 2.1 needs WordPress 6.5, PHP 8.1 and WooCommerce 8.0 or later, signs in customer accounts only (never staff or admin accounts), and removes everything it stored if you delete it. Customer names, emails, phone numbers and addresses are stored encrypted, and updates from WooCommerce and carriers are signature-checked. How OrderCtrl handles security has the details, and the What’s new page lists every release.
Frequently asked questions
Do I need to update WooCommerce to fix PHP2Shell?
No. WooCommerce says no WooCommerce or WordPress update is required or planned for PHP2Shell. The fix is a PHP update on your server. Update WordPress to 7.1.4 anyway, for its own security fixes.
How do I check which PHP version my store runs?
In WordPress, go to Tools → Site Health → Info → Server. WooCommerce shows it too, under WooCommerce → Status → Server environment. You need PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later in your branch.
Is PHP 8.1 still safe for a WooCommerce store?
There are no new PHP releases for 8.1 or older. For PHP2Shell, PHP’s security team published minimal source backports for 7.4, 8.0 and 8.1, and some Linux distributions and long-term support vendors ship fixes, so ask your host. WooCommerce recommends PHP 8.3 or newer.
My host says it patched PHP. Is there anything else to do?
Confirm the version in Site Health yourself, then update WordPress, WooCommerce and your extensions, remove plugins you no longer use, and check your user list for admin accounts you don’t recognize.
Sources
- PHP: news archive 2026 (security advisory and releases of October 21, follow-up advisory of October 23, Windows builds of October 26), checked October 28, 2026
- PHP: supported versions, checked October 28, 2026
- CISA: Critical Vulnerabilities in PHP Require Immediate Patching, October 21, 2026
- CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog, October 26, 2026
- WooCommerce developer blog: Critical Security Releases for PHP, October 21, 2026
- WordPress News: WordPress 7.1.4, October 28, 2026
- WooCommerce developer blog: New Requirement for WooCommerce 11.6: PHP 8.1+, September 29, 2026