Two critical PHP vulnerabilities scoring 9.2 on CVSS v4.0 allow unauthenticated remote code execution, and exploitation attempts are already showing up in the wild. Here is what that means for WordPress sites.
PHP is the runtime under most of the web, WordPress included, so a pair of unauthenticated remote code execution bugs in the language itself is not a niche concern for a handful of sysadmins. Sucuri.net reports that CVE-2026-109618 and CVE-2026-109619 both carry a CVSS v4.0 score of 9.2 and can let an attacker who has never logged in execute code on an affected server. Exploitation attempts are already being observed in the wild.
What the disclosure actually says
The two CVEs are rated critical, and the operative detail is the word unauthenticated. No valid session, no admin credentials, no plugin with a sloppy permission check required. An attacker reaching a vulnerable PHP install can run code on the host. Sucuri.net’s write-up frames the situation as a critical security update for PHP, and the fact that exploitation attempts are already in circulation puts this past the theoretical stage.
What the public reporting does not yet spell out is the exact set of conditions that make a given install exploitable, or which PHP versions are affected. That gap matters more than it might seem. A 9.2 score describes severity, not reachability. Whether your particular stack is exposed depends on details that a CVSS number cannot tell you.
Why this lands on WordPress site owners specifically
WordPress runs on PHP, and a very large share of production WordPress installs are sitting on whatever PHP version their host provisioned and never touched again. That is the practical problem here. The WordPress core team has spent years pushing hosts and users toward supported PHP branches, and the ecosystem has improved, but a long tail of sites still run end-of-life versions because the site works and nobody wants to break it on a Tuesday.
Those are precisely the installs least likely to receive a patch quickly. An unauthenticated RCE in the runtime means the WordPress admin login, the security plugin, and the firewall rules are all downstream of the actual vulnerability. If the PHP process itself can be made to execute attacker code, hardening the application layer does not close the hole.
Managed hosts that control their own PHP builds will likely move fast. Shared hosts vary enormously. Self-managed VPS and dedicated server customers are on their own clock, and that is where I would expect the slowest patching and the most successful exploitation.
The uncomfortable part: you may not control the fix
Most WordPress site owners do not compile PHP. They inherit it from a hosting panel, a container image, or a distro repository. That changes the response from “update a plugin” to “find out what your host is doing and when.”
Concretely, the questions worth answering now:
- Which PHP version is actually serving the site, not which one the hosting dashboard claims.
- Whether that version is still receiving security backports from the vendor or distro maintainer.
- Whether the host has published a timeline for the patched build.
- Whether the site can be moved to a supported branch without breaking plugins or themes.
That last item is the one people avoid, because PHP upgrades break things. But the alternative here is running an unauthenticated RCE on a box that is already being probed.
What to watch next
The disclosure is thin on affected versions and exploitation mechanics, and that will fill in over the coming days as researchers publish technical detail and vendors ship patched builds. Watch for the affected version range first, because that single fact determines whether this is an emergency for your stack or a note to file. Watch for proof-of-concept code next. Once a working exploit is public, the window between disclosure and mass scanning collapses, and unpatched hosts get picked off by automated tooling rather than targeted attackers.
There is a broader lesson here that the WordPress ecosystem keeps relearning. Application-layer security gets all the attention because that is where the plugins, themes, and admin panels live. But the language runtime underneath is a shared dependency that most site owners treat as invisible infrastructure. When it fails, every layer above it fails with it, and the usual defenses do not help.
If you run WordPress and you do not know your PHP version off the top of your head, that is the first thing to fix today. Not because this specific CVE is guaranteed to hit you, but because the answer determines whether you have a problem you can solve or a problem you have outsourced to someone who has not told you their plan.
Source: Sucuri.net