For WordPress, PHP2Shell remediation requires patching the PHP runtime. The application version helps identify compatibility blockers; it cannot establish exploitability or prove that either CVE is fixed.
WordPress - PHP compatibility for the PHP2Shell fix
| Release sample | Declared PHP requirement | Declared patch candidates | Original source |
|---|---|---|---|
| 6.9 | >=7.2.24 | raw.githubusercontent.com ↗ | |
| 6.8 | >=7.2.24 | raw.githubusercontent.com ↗ | |
| 6.7 | >=7.2.24 | raw.githubusercontent.com ↗ | |
| 6.6 | >=7.2.24 | raw.githubusercontent.com ↗ | |
| 6.5 | >=7.0.0 | raw.githubusercontent.com ↗ | |
| 6.4 | >=7.0.0 | raw.githubusercontent.com ↗ | |
| 6.3 | >=7.0.0 | raw.githubusercontent.com ↗ | |
| 6.2 | >=5.6.20 | raw.githubusercontent.com ↗ | |
| 5.9 | >=5.6.20 | raw.githubusercontent.com ↗ | |
| 5.8 | >=5.6.20 | raw.githubusercontent.com ↗ | |
| 4.9 | >=5.2.4 | raw.githubusercontent.com ↗ |
Candidates match only this declaration against the first PHP2Shell fixes on supported branches. They do not establish tested compatibility, vendor support or a complete dependency match. PHP compatibility for the PHP2Shell fix ↗
Identify the PHP2Shell repair scope
Files and package identity
wp-includes/version.phpwp-content/plugins/wp-content/themes/
WordPress - Remove blockers to patch PHP2Shell
WordPress core, themes and plugins have separate PHP constraints. Identify the installed core in Site Health or version.php and include child themes, must-use plugins and drop-ins in the audit. Update and test a complete copy before switching the domain’s Web PHP. The low minimum in an old core release is not a recommendation to keep an unsupported interpreter.
Dependencies and custom code to review
Official upgrade documentation ↗WordPress - PHP compatibility for the PHP2Shell fix ↗Check site functions after the PHP2Shell fix
Inventory before fixing PHP2Shell
Use an authorized working copy.
php -v
php --ini
php -mWordPress - PHP2Shell patch verification
Verify both CVE fixes in the PHP actually serving this site. Replace or restart old Web workers, queue workers and replicas. A working homepage or a newer CLI binary is insufficient evidence.
3. Restart and verify every instance ↗