Current
PHP2Shell: Is my WooCommerce store patched?
The critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) are in the server, not in WooCommerce or WordPress. Plugin and WP updates don't change that. What matters is whether your host has applied the fix.
The four most important steps
- 1Ask your host in writing whether the fix is active and PHP has been restarted.
- 2PHP 8.1 or older? Plan a move to 8.3 or newer.
- 3Check the interim measure: session.upload_progress.enabled = 0 (closes only one attack path, does not replace the update).
- 4Look for traces: new admin accounts, unknown PHP files in the uploads folder, modified core files.
Template for asking your host
Hello, please confirm in writing whether the fixes for CVE-2026-109618 and CVE-2026-109619 have been applied to my hosting package [domain], whether PHP was restarted afterwards, and which PHP version or build is active. Thank you.
Plugin: PHP2Shell Check (coming soon)
A free WordPress plugin that checks your configuration and produces a report. Important: it does not fix the vulnerability, it shows where you stand.