The PHP vulnerability you need to know about
In June 2024, security researchers disclosed CVE-2024-4577 — a critical remote code execution (RCE) vulnerability in PHP with a CVSS score of 9.8 out of 10. That is as serious as vulnerabilities get. An unauthenticated attacker could exploit it to run arbitrary commands on a vulnerable server, effectively taking full control.
The vulnerability affected PHP running in CGI mode on Windows servers across PHP 8.1 before 8.1.29, PHP 8.2 before 8.2.20, and PHP 8.3 before 8.3.8. Patches were released immediately, but exploitation began within hours of public disclosure. Security researchers observed mass scanning activity within 24 hours.
CVE-2024-4577 is not the only reason to worry. The deeper problem is that a large portion of UK WordPress sites are still running PHP versions that reached end-of-life years ago. End-of-life means no more security patches — ever. Every new vulnerability discovered in that version stays open permanently, with no official fix coming.
Key fact
According to WordPress.org stats, approximately 17% of WordPress sites still run PHP 7.4 — a version that reached end-of-life in November 2022 and has received zero security patches for over three years.
Which PHP versions are end-of-life right now
PHP has a defined lifecycle for each major version: active support (new features and bug fixes) followed by security-only support, then end-of-life (nothing). Once a version reaches end-of-life, running it is a liability.
| PHP Version | End-of-Life Date | Status | Action Required |
|---|---|---|---|
| PHP 7.4 | November 2022 | End-of-Life | Upgrade immediately |
| PHP 8.0 | November 2023 | End-of-Life | Upgrade immediately |
| PHP 8.1 | December 2025 | End-of-Life | Upgrade now |
| PHP 8.2 | December 2026 | Security Only | Acceptable, plan upgrade |
| PHP 8.3 | November 2027 | Active Support | Recommended |
| PHP 8.4 | November 2028 | Active Support | Latest stable |
WordPress officially recommends PHP 8.3 in 2026. Both PHP 8.3 and 8.4 are fully compatible with WordPress 6.x and most well-maintained plugins.
How to check your PHP version in 2 minutes
Before doing anything else, find out what PHP version your WordPress site is actually running. There are three quick ways:
Method 1: WordPress Site Health (easiest)
- 1. Log in to your WordPress dashboard
- 2. Go to Tools → Site Health → Info
- 3. Expand the Server section
- 4. Look for “PHP version”
If the version shown is 8.1 or lower, you need to act.
Method 2: Hosting control panel
Log in to cPanel, Plesk, or your managed host dashboard. Look for a section called PHP Version Manager, Select PHP Version, or PHP Configuration. The current version will be displayed alongside a dropdown to change it.
Method 3: WP-CLI (for developers)
If you have SSH access and WP-CLI installed, run:
php -vThe first line of output will show the PHP version.
Before you update: compatibility checks you must not skip
Updating PHP without preparation can break your WordPress site. Newer PHP versions enforce stricter coding standards and have removed deprecated functions that older plugins and themes still use. Follow these steps before touching anything:
- 01
Create a full backup
Back up your database and all files before making any change. Use UpdraftPlus, BlogVault, or your host's built-in backup tool. Download a copy to your local machine. If anything breaks during the PHP update, you can restore to a working state within minutes.
- 02
Update all plugins and themes
Go to Dashboard → Updates and apply all available plugin and theme updates. Most modern plugins have already been updated for PHP 8.x compatibility. Running old plugin versions is the most common cause of breakage after a PHP upgrade.
- 03
Run the PHP Compatibility Checker
Install the free PHP Compatibility Checker plugin (by WP Engine). Set your target PHP version to 8.3 and run the scan. It will flag any plugins or themes with code that is incompatible. Replace or update any flagged items before proceeding.
- 04
Test on staging first
If your host provides a staging environment (Kinsta, WP Engine, and SiteGround all do), clone your site there and update PHP on the staging copy first. Test every key page, form, and checkout flow before applying the change to production.
How to update PHP on your hosting platform
The process differs depending on your hosting provider. Here are step-by-step instructions for the most common platforms used by UK WordPress sites:
cPanel (SiteGround, Hostinger, 20i, many UK shared hosts)
- 1. Log in to cPanel
- 2. Scroll to the Software section
- 3. Click Select PHP Version or MultiPHP Manager
- 4. Select your domain from the list
- 5. Choose PHP 8.3 from the dropdown
- 6. Click Apply
- 7. Visit your website immediately to confirm it loads correctly
Kinsta
- 1. Log in to MyKinsta
- 2. Select your site
- 3. Go to Tools
- 4. Under PHP Engine, click Modify
- 5. Select PHP 8.3 and confirm
- 6. Changes apply instantly with no downtime
WP Engine
- 1. Log in to your WP Engine User Portal
- 2. Select the environment (production or staging)
- 3. Go to PHP version under the Overview tab
- 4. Click Upgrade PHP and select 8.3
- 5. WP Engine will run a compatibility scan automatically before applying the change
Cloudways
- 1. Log in to the Cloudways platform
- 2. Go to Servers and select your server
- 3. Click Settings & Packages
- 4. Go to the Packages tab
- 5. Update the PHP version to 8.3 and click Save Changes
After updating
Immediately visit your homepage, a blog post, your contact form, and — if you run WooCommerce — your shop and checkout. If anything appears broken, contact your host's support or revert to your previous PHP version via the same panel while you investigate the cause.
Signs your site may already be compromised
If your site has been running an outdated PHP version for months or years, it is worth checking whether it has already been compromised. Attackers often operate silently — injecting spam links, harvesting customer data, or using your server to send phishing emails — without triggering any obvious front-end symptoms.
- →
Unknown admin users
Go to Users in your WordPress dashboard. Any account you did not create is a red flag.
- →
Unexpected files in wp-content
Check your file manager or FTP for PHP files in the uploads folder — legitimate uploads should be images, PDFs and similar, not .php files.
- →
Site redirecting visitors
Ask a colleague on a different network to visit your site. Attackers often redirect mobile users or first-time visitors to spam sites while showing the normal site to you.
- →
Google Search Console warnings
Check for Security Issues under Search Console. Google flags sites serving malware or hosting phishing pages quickly.
- →
Host has suspended your account
Hosts automatically scan for malicious files and suspend accounts when they find them. Suspension is often the first sign of a compromise.
- →
Unusual server resource spikes
A sudden spike in CPU or bandwidth usage can indicate your server is being used to send spam or conduct brute-force attacks on other sites.
If you suspect your site has been compromised, do not just update PHP and hope the problem goes away. Attackers often leave backdoors that persist through updates. You need a full malware scan, a clean restore from a known-good backup, and a hardening audit before relaunching.
Frequently asked questions
What is CVE-2024-4577?+
CVE-2024-4577 is a critical (CVSS 9.8) remote code execution vulnerability in PHP CGI mode on Windows servers. It was disclosed in June 2024 and affects PHP 8.1 before 8.1.29, PHP 8.2 before 8.2.20, and PHP 8.3 before 8.3.8. Patches were released immediately. If you are on any of those unpatched versions, update to the latest patch release now.
PHP 7.4 has been EOL for years. Is my site really still at risk?+
Yes — more so now than ever. Security researchers and automated scanners continuously discover new vulnerabilities in EOL PHP versions. Because no patches are released for EOL versions, these vulnerabilities stay permanently open. The longer you run an EOL version, the more known exploits accumulate with no fix available.
My host says I am on PHP 7.4 and upgrading will break my site. What do I do?+
This is a plugin or theme compatibility problem, not a PHP problem. Install the PHP Compatibility Checker plugin, identify which items are incompatible, and update or replace them. Most major WordPress plugins have supported PHP 8.x for years. If a plugin has not been updated since 2021, find a modern alternative. Contact WebAnts if you need help navigating the upgrade safely.
Does updating PHP cost anything?+
Changing your PHP version through your hosting control panel is free on all mainstream hosts. The cost is in preparation time — running compatibility checks, updating plugins, and testing. WebAnts handles this as a one-off service starting from £150.
Will my WooCommerce store still work after updating to PHP 8.3?+
WooCommerce has supported PHP 8.3 since version 8.0 (released late 2023). If you are running WooCommerce 8.0 or later with up-to-date extensions, updating to PHP 8.3 should be straightforward. Run a full compatibility check and test your checkout flow on staging before updating production.
Related reading
Not sure if your site is affected? We will check it for free.
WebAnts will audit your PHP version, run a compatibility check across all your plugins and themes, and tell you exactly what needs updating — at no charge. If you need us to handle the upgrade safely, we can do that too.
hello@webants.io · +44 20 3983 9795 · WebAnts Ltd, London