Is your WordPress site affected by PHP2Shell? A two-minute check

WordPress runs on PHP, so PHP2Shell affects WordPress sites. You don’t need server access to see where you stand.

1. Log in to your dashboard

Go to yoursite.com/wp-admin and log in with an Administrator account. If you don’t have one, ask whoever built or looks after your site.

2. Find your PHP version

Go to Tools › Site Health › Info, open the Server section, and look for the line PHP version. It shows a number like 8.3.27 or 7.4.33.

Can’t see Site Health? Your hosting control panel (cPanel, Plesk and so on) shows the PHP version too.

3. What your number means

Your version	What it means	What to do
8.2 or higher	Supported, fix available	Make sure you’re on 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or newer
8.1 or lower	Out of support, no official fix	Plan an upgrade now

PHP 8.2 itself stops getting security fixes on 31 December 2026, so if you’re on 8.2, plan a move to 8.3 or 8.4 soon anyway.

If you’re on 8.2 or higher

• Managed hosting? Your host usually updates PHP for you. Check their status page or ask support to confirm it’s done.
• Your own server or VPS? Install the patched PHP release, then fully restart PHP and your web server.
• Then check again in Site Health. If you see a different number, ask your host whether they’ve backported the fix; Linux distributions often patch without changing the version number.

If you’re on 8.1 or lower

This is a bigger job. A PHP upgrade usually means updating WordPress, your theme and every plugin too, and some old plugins won’t survive it.

1. Back up your files and database.
2. Update WordPress, your theme and plugins. Replace anything abandoned.
3. Test on a staging copy, then switch the PHP version in your hosting panel.
4. Meanwhile, ask your host whether they’ve backported this fix to your version.

Stuck? Get in touch.