Two Critical PHP Flaws Allow Unauthenticated Code Execution — and a WordPress Update Will Not Fix Them

Two critical PHP flaws (CVE-2026-109618, CVE-2026-109619) allow unauthenticated code execution on WordPress sites. Updating WordPress won't fix it.

• Wordfence published research on two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, that can be exploited without authentication to execute code.
• Any WordPress site is exposed if the PHP runtime underneath it is unpatched — including district, school and department sites on shared or managed hosting with pinned PHP versions.
• Updating WordPress core, themes or plugins does not remediate this; the PHP package must be updated and the PHP service restarted before the fix is actually live.

What to do now

1. Inventory every WordPress and PHP-backed site you own or fund — including sites run by individual schools and departments — and record the exact PHP version and PHP-FPM pool or mod_php handler each one uses.
2. Obtain the corrected PHP build from the PHP project, your Linux distribution, or your hosting provider, and confirm the affected version ranges against the vendor advisory before scheduling the change.
3. Apply the patched PHP package, then restart PHP-FPM pools or the web server so worker processes load the new binary; a package upgrade alone can leave old processes serving requests.
4. Treat WordPress core, theme and plugin updates as separate hygiene work, not as remediation for this issue, and verify PHP again after any host migration or container rebuild.
5. Until patching is complete, enable WAF or virtual patching rules, and review web server and PHP logs for unauthenticated requests that suggest exploitation attempts; recheck hosts afterwards to confirm no vulnerable PHP process remains.

Related items

• Why It s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing Found