WordPress PHP Vulnerability Triage: Non-Technical Protection Guide

When a critical PHP security flaw was announced, small business owners experienced confusion. The vulnerability, CVE-2026-109618 and CVE-2026-109619, was found in WordPress sites and could allow remote attackers to execute malicious code. This guide is designed for non-technical WordPress users to understand how to check if their website is affected, what their hosting provider is doing, how to block exploits for free, and how to verify their site has not been breached.

PHP runs WordPress sites and the vulnerability resides in the session upload progress handler. If the PHP engine is not patched, attackers can exploit the flaw and run commands without logging in. The PHP security team has released patched versions, but many hosting accounts run outdated PHP branches that are not automatically updated.

To check your PHP version, log into your WordPress dashboard, navigate to Tools > Site Health, and check the Server section. Compare your version against the patched baseline. If you are running a vulnerable version, contact your hosting provider for confirmation and guide them to verify if your site is running the patched version or if an edge WAF is filtering malicious payloads. Avoid blindly upgrading PHP versions to keep your site secure.