Fix php2shell on WordPress hosting

1. Find your exact PHP version

WordPress admin → Tools → Site Health → Info → Server → PHP version. You need the full number, for example 8.3.36, not just 8.3.

Your host’s panel usually shows only the branch. If Site Health shows a version below the fix for your branch, the site is affected.

Hostinger

Websites → Dashboard next to your site → PHP Configuration → select the version → Update. The change takes a couple of minutes.

The selected version applies to every website on the hosting plan. Only PHP 8.2 and later can be selected.

SiteGround

Websites → Site Tools → Devs → PHP Manager → PHP Version → pencil icon.

“Managed PHP” lets SiteGround choose and update the version; “Change PHP Version Manually” pins it and stops automatic updates. Confirm to save.

GoDaddy (Web Hosting with cPanel)

Product page → Web Hosting → Manage → Settings → Server Settings → PHP Version → Change → choose a version → Continue → Save Changes.

Or in cPanel Admin → Software → Select PHP Version → Set as current.

Sites still on PHP 8.1 or older are moved to GoDaddy’s paid PHP Extended Support. Switching to 8.2 or later avoids it.

Bluehost

Bluehost Portal → Websites → Manage Site → Advanced → PHP Version → Change Version → Apply.

Or Hosting → My Plans → cPanel → Software → MultiPHP Manager → select the domains → PHP Version → Apply.

2. Ask your host to confirm the patch

If Site Health shows a version below the fix, or your host builds its own PHP, send this to support:

Copy and send:

Hello, my site runs PHP <version>. Does your PHP build include the fixes for CVE-2026-109618 and CVE-2026-109619 (fixed upstream in 8.5.12, 8.4.27, 8.3.36, 8.2.35)? If not, when will it be updated? Thank you.

3. Verify

Reload Site Health and check the PHP version again. Test your site’s front end, admin and checkout or forms after switching branches.

Then run the checker on the home page. If the version is hidden, Site Health is your source of truth.