WordPress itself runs on PHP, so every WordPress site is affected unless its server runs PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or newer. On PHP 8.2+ we patch for $249. On PHP 8.1 or older the site must be upgraded, which means updating plugins and fixing the theme first. That's our Legacy PHP Upgrade, from $890.
How to check your WordPress PHP version
- In wp-admin go to Tools → Site Health → Info → Server and read PHP version.
- Note the full sub-release (for example 8.2.30, not only 8.2). That decides whether a patch exists.
- Or send us your URL for a free passive check.
"There has been a critical error on this website" after a PHP update
That's WordPress catching a fatal PHP error, usually from a plugin or theme that uses code PHP 8 removed. WordPress emails the admin a recovery-mode link that names the culprit. The usual causes:
- Outdated plugins with no PHP 8 release (page builders, sliders and old form plugins are frequent offenders)
- Custom code in
functions.phpusingeach(),create_function()or oldmysql_*calls - Premium themes that were never updated after purchase
- Old WooCommerce extensions that are out of step with WooCommerce core
Switching PHP back in your hosting panel restores the site, but leaves it exposed. The real fix is updating and repairing the code. That's what we do, on staging.
What we update and what we fix
| Part of your site | What we do |
|---|---|
| WordPress core | Updated to the latest version |
| Plugins from wordpress.org | Updated; abandoned ones replaced with maintained alternatives, with your approval |
| Premium themes and plugins | Updated through your license; we never redistribute licensed code |
| Custom theme / child theme | Incompatible code rewritten for PHP 8.3/8.4 |
| Snippets and custom plugins | Scanned and fixed line by line |
| WooCommerce | Checkout, payments, emails and stock tested on staging |
Is your WordPress site just a brochure?
If it's pages, photos and a contact form, with no shop, bookings or logins, you may not need WordPress or PHP at all. A Static Rebuild turns it into fast, plain HTML that no PHP flaw can touch, from $490.
Frequently asked questions
Is my WordPress site affected by the October 2026 PHP vulnerabilities?
Yes, unless your server runs PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or newer. WordPress runs on PHP, and the flaw is in PHP itself, so WordPress security plugins can't block it.
Does it matter if my WordPress site has no customer data?
Yes. The flaw lets attackers run code on the server. Even a site with no data can be defaced, used to spread malware or host phishing pages, stuffed with spam pages that wreck its Google ranking, flagged by Google as harmful, or suspended by the host.
Which PHP version should WordPress use?
PHP 8.3 or 8.4, on the fixed releases 8.3.36 or 8.4.27 or newer, is the safe target for most WordPress sites today, once plugins and theme are compatible.
Will updating PHP break my WordPress plugins?
Plugins that haven't been updated for PHP 8 can cause a critical error. That's why we update and test on a staging copy first and only switch the live site once everything works.
How much does a WordPress PHP update cost?
Emergency Patch & Verify is $249 for sites already on PHP 8.2+. Legacy PHP Upgrade for sites on PHP 8.1 or older starts at $890. You get a fixed quote first.
Get WordPress onto patched PHP
Free check, then a fixed quote. Staging first, rollback ready.
Related services
Last updated October 22, 2026. LegacyPatch is an independent service provider and is not affiliated with The PHP Group. Prices in USD; GBP and EUR invoices on request.