Due to the critical severity of the issues, store owners are encouraged to immediately update their installations of PHP. These vulnerabilities are not specific to WooCommerce or WordPress and affect any server that hosts a PHP application. No WooCommerce or WordPress update is required or planned for these issues.
For WooCommerce stores hosted on Automattic infrastructure (WordPress.com, WordPress VIP, Pressable, and WP Cloud), your sites are already protected against the recently disclosed PHP security issues. Automattic worked closely with the PHP Security team to ensure that all sites hosted on our platform were protected as soon as possible.
Your web host may already be working to update PHP and put web application firewall (WAF) rules in place to mitigate the vulnerabilities, but you should still check for updates from your web host and, if necessary, update PHP as soon as possible.
Within WordPress, you can see which version of PHP your site runs under Tools > Site Health > Info > Server. Many web hosts provide this information in your web hosting administration panel too.
Versions of PHP prior to 8.2 no longer receive security updates from the PHP project. WooCommerce recommends and is fully compatible with PHP 8.3 or newer. The minimum requirement for WooCommerce is PHP 7.4, but we are actively raising that minimum requirement in future releases.
If your site runs a PHP version prior to this and you manage your own web hosting, you should consider taking your server offline while you prepare to update to a newer version of PHP. This advice is being published by several national cyber security agencies. To quote the UK National Cyber Security Centre:
Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.
Further information:
Leave a Reply