WordPress PHP version: check it and update it for PHP2Shell

Want to know whether your WordPress site is affected by PHP2Shell, not just how to change PHP? Start with PHP2Shell and WordPress.

How do I check my WordPress PHP version?

You need an administrator account.

1. In the WordPress dashboard, open Tools → Site Health.
2. Click the Info tab and expand Server.
3. Read PHP version and PHP SAPI (how PHP runs, such as FPM/FastCGI or Apache).

Enter both in the PHP version checker to see whether PHP2Shell affects your site.

Is my WordPress site affected by PHP2Shell?

It depends on the PHP version, not the WordPress version. WordPress runs on PHP, and PHP2Shell is a flaw in PHP itself. If the PHP version in Site Health is older than the first fixed release for its branch, the site is affected, unless your host runs a Linux distribution package that contains a backported fix.

Is updating WordPress and plugins enough for PHP2Shell?

No. WordPress core, theme and plugin updates don’t touch the PHP runtime underneath, and PHP2Shell is fixed only by updating PHP itself. Keep WordPress, themes and plugins updated anyway, since those updates fix other problems.

How do I update the PHP version for WordPress?

That depends on your hosting:

• Shared or managed WordPress hosting: your host updates PHP. Some let you pick a version in their dashboard; choose a fixed one in the same branch. Otherwise send them the request in the PHP2Shell patch guide.
• cPanel or Plesk: switch the domain’s PHP version, then confirm in Site Health. See change PHP version in cPanel.
• Your own server: update PHP packages and restart PHP-FPM or Apache. See update PHP on Ubuntu.
• Docker: rebuild with a fixed PHP image. See Docker PHP image.

Will a newer PHP version break my WordPress site?

Moving within the same branch (for example to the newest 8.3 release) contains fixes only and rarely causes problems. Jumping branches, such as 7.4 to 8.3, can break old plugins and themes. Before changing branch, make a full backup, use a staging copy if your host offers one, and update plugins and themes first. WordPress’s own guide recommends the same.

Site Health still shows the old PHP version after the update. Why?

Site Health reports the PHP that served that page. If it hasn’t changed, the new PHP wasn’t applied to this domain, or PHP workers haven’t restarted yet. Check the domain’s PHP setting and ask your host to confirm the restart. A host’s backported package may also keep the old number; ask which security notice includes the fix.

Does a maintenance mode plugin protect WordPress from PHP2Shell?

No. Maintenance mode is a WordPress feature running on PHP, and some attack paths happen before WordPress code runs. If you can’t update PHP yet, ask your host to block traffic before it reaches PHP or take the site offline temporarily.

Is PHP2Shell the same as wp2shell?

No. wp2shell is the name of a separate critical vulnerability in WordPress core, fixed by updating WordPress. PHP2Shell is fixed by updating PHP. A WordPress site needs both up to date. More on the PHP2Shell checker homepage.

Which sources support this page?

• WordPress.org: Site Health screen
• WordPress.org: Update PHP
• The PHP Group: security advisory
• cPanel: MultiPHP Manager
• Plesk: PHP settings
• Rapid7: wp2shell, a separate WordPress core vulnerability