WordPress News: Critical PHP Flaw Demands Action (Week of 27 October 2026)

This week's WordPress news is dominated by one big patch job that has nothing to do with WordPress itself, plus a quieter but serious bug in one of the most popular migration plugins on the market. Neither one is a Death Star level threat, but both deserve action before the weekend. If you run a WordPress site, here is what actually needs your attention and what can safely wait.

Get your host to confirm your PHP version is patched

On October 21, 2026, the PHP project shipped emergency fixes for two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, each carrying a CVSS 4.0 score of 9.2 out of 10. Wordfence's testing confirmed the risk is real, running a working code execution proof of concept against one of the two flaws in a specially configured lab, though the same test only crashed a standard, optimised PHP build. Search Engine Journal also covered the story, noting it affects any site running PHP, WordPress or not. Wordfence has said it has not yet confirmed successful real world compromises, but expects that to change as attackers refine their approach, so treat this as urgent rather than settled.

What this means for you: Updating WordPress itself will not fix this. The vulnerabilities live in PHP, the server level software WordPress runs on, so your host or server administrator needs to apply the patch and restart PHP. If you're on managed WordPress hosting, this has most likely already been handled, but a quick email to confirm is worth your time. If you manage your own server, patch PHP today rather than at the next convenient maintenance window. For the bigger picture on layered protection, see our guide to WordPress security best practices.

Update Duplicator before your next site migration

Wordfence's threat intelligence team disclosed a high severity (CVSS 8.8) PHP object injection vulnerability, CVE-2026-82814, affecting Duplicator and Duplicator Pro, plugins that together run on more than a million sites. The attack path is unusual: an attacker needs no account at all. They simply leave an ordinary comment on your site containing a malicious encoded value, and it sits there harmlessly, even unapproved, until an administrator later builds a migration package that happens to include it. From there, Duplicator Free's installer can be tricked into running operating system commands, while Duplicator Pro's version can delete an existing file. Wordfence demonstrated that deleting wp-config.php can reopen WordPress's setup wizard, letting an attacker connect a database of their own and ultimately take over the site. The developer patched the underlying flaw in version 5.0.0 back on September 8, and Wordfence rolled out an extra firewall rule for paid customers on October 15 (free users get it November 14).

What this means for you: If Duplicator or Duplicator Pro is installed anywhere on your site, update to version 5.0.0 or later now. Updating does not retroactively fix old migration packages already sitting on your server, since they carry their own outdated installer code. Before your next migration, generate a fresh package with the updated plugin, and remove any old installer files that are still publicly accessible. This is also a good prompt to review your backup strategy more broadly; our guide on backups done right covers what a sound setup looks like.

WordPress 7.2 enters testing: nothing to do yet

WordPress 7.2 reached Beta 1 on October 20, 2026, starting the formal testing cycle ahead of a planned final release on December 8. According to the official WordPress.org announcement and the WordPress Developer Blog, the beta introduces a new default theme called Ipsum and extends the design tools added across the dashboard earlier this year, with Release Candidate 1 due November 17.

What this means for you: Nothing, you are fine. Beta software is built for developers and testers to find bugs, not for live sites. Don't install it on anything that matters to your business. We'll cover what's actually worth knowing once 7.2 ships in December.

Two separate security issues, one in the server stack beneath WordPress and one in a widely used plugin, are the real story this week. Both are patched; both now depend on someone actually applying the fix rather than filing it away. If you'd rather not track CVE numbers and changelogs yourself, a maintenance plan handles updates and monitoring automatically, so patches like these get applied before they become your problem.

May the Code Be With You.