There's a serious security hole affecting WordPress sites. Don't blame WordPress.

If you've got a WordPress site, you might see some scary headlines this week. Before anyone tells you WordPress is insecure and you need a new website, let me explain what's actually going on.

WordPress hasn't done anything wrong. The problem is underneath it.

What's happened, in plain English

WordPress is written in a programming language called PHP. Your hosting company runs PHP on its servers, and PHP runs WordPress.

On 21 October the people who look after PHP released a fix for two serious security holes in PHP itself. Security experts rate both of them 9.2 out of 10. In the worst case, someone could take control of the server your website lives on by sending it one specially crafted request. They don't need your password. They don't need to log in.

The European Union's cyber security team has told organisations to fix this straight away. Examples of how to exploit it are already being shared online.

So why isn't it WordPress's fault? Because the attack happens before WordPress even starts. It doesn't matter how good your plugins are, how strong your passwords are or which security plugin you've got installed. The hole is in the engine, not the car. Joomla, Drupal, Magento and every other PHP website are in the same position this week.

Is my website affected?

Probably, until your host says otherwise. Every website running on PHP is in scope, and that's the vast majority of WordPress sites.

Here's what to do:

1. Check your hosting company's status page or emails. Good hosts have been rolling this out since Wednesday afternoon. If you can't find anything, message their support and ask: "Have you patched PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 on my server?"

2. Check which PHP version your site uses. In WordPress, go to Tools, then Site Health, then the Info tab, and open the Server section. If it says PHP 8.1 or lower, your site is on a version that no longer gets updates, and you need an upgrade, not just a patch.

3. If you run your own server or VPS, nobody is doing this for you. It needs patching today.

4. Keep an eye out for anything odd. Admin users you don't recognise, pages you didn't create, or your site suddenly redirecting somewhere strange.

I can sort it for you

If you're not sure where to start, or your host isn't answering, this is exactly the sort of job I do for small businesses around Hull and East Yorkshire. I'll check which PHP version you're on, make sure the fix is in place, upgrade PHP if you're on an old version, and check your site for any signs someone got in. I'll also make sure your plugins, theme and WordPress itself are up to date while I'm there. You can read more about how I look after WordPress sites in Hull.

I'll tell you honestly if your setup needs more than that. Most of the time it doesn't.

Why does this keep happening?

You're not imagining it. Security scares really are getting more common, and there are a few reasons.

Computers are finding the bugs now. AI tools have got very good at reading code and spotting weaknesses. That's good news for the people fixing them, but attackers have the same tools. The time between a problem being announced and criminals using it has shrunk from weeks to hours.

The numbers are going up fast. Patchstack, a company that tracks WordPress security, counted 11,334 new vulnerabilities in WordPress plugins and themes in 2025. That's 42% more than the year before. Around 91% of them were in plugins, not WordPress itself. For the ones attackers went after hardest, the typical gap between the problem going public and the first attack was five hours.

Lots of sites are left alone. A business gets a website built, it goes live, and nobody touches it again for three years. The plugins go out of date, the PHP version goes out of date, and the site quietly becomes an easy target. That's not anyone's fault exactly. It's just that websites aren't a one-off purchase any more. They need looking after, like a van needs an MOT.

PHP websites are everywhere. WordPress powers a huge share of the web, which makes it a big target. When a flaw like this one turns up, attackers can scan millions of sites at once looking for ones that haven't been patched.

None of that means WordPress is a bad choice. It's a perfectly good choice for lots of small businesses, and I build and look after plenty of WordPress sites. It just means somebody needs to be keeping an eye on it.

The short version

• This is a problem with PHP, not with WordPress.

• Your site is at risk until your host or developer has patched PHP.

• Check with your host today, and check which PHP version you're on.

• If your site hasn't been updated in a while, now is the time.

If you'd like me to check your site, book a free 30-minute call or drop me a message. I'll let you know where you stand, in plain English, without the scare stories.