Wordfence: WordPress patching insufficient against two critical PHP RCEs

Wordfence has published specific tests on WordPress for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, disclosed on 21 October 2026. The key takeaway from the post: updating WordPress is pointless if the server's PHP version remains outdated. For hosting providers and site administrators, this means checking the control panel or your provider's settings, not the WordPress update dashboard.

The two flaws

Both CVEs carry a CVSSv4 score of 9.2 and allow unauthenticated remote code execution with web process privileges. They affect PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. According to an advisory from the Canadian Centre for Cyber Security, the greatest risk lies with mod_php, where a demonstrated exploit triggers the vulnerability before application code even runs.

PHP Version	Vulnerable if earlier than	Patched version
8.5.x	8.5.12	8.5.12
8.4.x	8.4.27	8.4.27
8.3.x	8.3.36	8.3.36
8.2.x	8.2.35	8.2.35

Versions 8.1 and earlier no longer receive official fixes from the PHP project; some distributions offer separate backports.

What Wordfence found

In preliminary testing, a proof-of-concept request against PHP 8.5.11 (vulnerable) crashed the process, whilst PHP 8.5.12 (patched) handled the same request without issue. In a second test, on WordPress 7.1.3 with an Ubuntu package based on vulnerable PHP 8.5.4, specially crafted requests caused process errors or restarts in some configurations. Wordfence notes it was unable to achieve code execution itself with this CVE: the crash is reproducible, but RCE is not, at least in their testing.

What to do

• Verify the actual PHP version running on your server, not what's shown in the control panel: run php -v from the command line.
• Update to the correct release for your branch (8.2.35, 8.3.36, 8.4.27 or 8.5.12) and restart the service: systemctl restart php8.3-fpm (adapt to your version number).
• If you run multiple sites on a single server, restart only once per shared PHP-FPM pool, not for each vhost.

Wordfence is a product owned by WordPress.com / Defiant, not Prime Software.