The WordPress PHP Vulnerability Is Three CVEs With Three Owners

The recent WordPress PHP vulnerability consists of three distinct remote-code-execution risks. These risks stem from three separate components, each with its own owner and release channel. WordPress updates helped address roughly one-third of the issue. However, there are additional CVEs affecting other layers of the WordPress ecosystem.

1. The PHP runtime vulnerability (CVE-2026-109618 and CVE-2026-109619) was fixed in PHP releases 8.2.35, 8.3.36, 8.4.27, 8.5.12, and later. These fixes address issues related to request-memory handling and stale global state.

2. WordPress Core vulnerabilities (CVE-2026-119977) affect versions 4.7.0 through 7.1.3, with a remediation deadline of 6 November. This vulnerability is exploited through a time-of-check-to-time-of-use race during the full-package upgrade process.

3. The plugin CVE (CVE-2026-120534) affects ACF Extended PRO through version 0.9.2.6. This vulnerability allows for unrestricted file uploads with dangerous types, leading to arbitrary shortcode execution and contributor-level XSS.

The core update and backports were released by WordPress, while the PHP runtime vulnerabilities were addressed by the PHP team. The plugin vulnerability was fixed by the plugin developer. It's crucial to ensure that each layer of the WordPress ecosystem is updated to mitigate the vulnerabilities.

Upon remediation, thorough triage and testing should be conducted to ensure there are no unintended consequences. This includes checking web, PHP, application, WAF/CDN, authentication, and hosting control-plane logs for any unexpected changes. Additionally, verify that backups are taken and restorable before proceeding with the remediation process.