WooCommerce Store and the PHP Flaw: What Shop Owners Should Do

Key takeaways

• A WooCommerce shop uses the server's PHP. The fix for the October 2026 flaws is a PHP update on the host, in the patched build on the shop's branch.
• WooCommerce lists its own PHP advice. Its server requirements page documents PHP 8.3 or greater and says it has tested up to PHP 8.4.
• You can see the version in two clicks. In WooCommerce, open Status and look at the Server environment section for the PHP version row.
• Back up before any change. WooCommerce's PHP guide recommends a backup before updating, and we add a staging copy and a test order.
• Payments depend on the gateway. How card data is handled depends on the gateway and the setup, so ask your gateway for its guidance.
• A hosted platform is the other route. Shopify has no PHP for you to patch, though we found no Shopify statement about this advisory.

Why a shop is different from a brochure site

If a brochure site is down for an hour, someone misses a phone number. If a shop is down, or checkout breaks in the middle of a sale, you lose orders. A shop also holds customer names, addresses and order history. Both facts make the PHP update more pressing and the update itself more delicate.

The facts of the event are in our main guide to the October 2026 PHP vulnerability. In short, php.net announced fixes on 21 October 2026 for two critical flaws that could let an unauthenticated outsider run code on a server. WordPress.org said no WordPress update is needed, and the server's PHP is what to update. WooCommerce is a WordPress plugin, so the same applies to your shop.

WooCommerce's security FAQ puts the link in plain words: because the shop runs on WordPress, it is only as secure as that WordPress install and the host behind it.

What WooCommerce says about PHP

Source: WooCommerce server requirements page and its update PHP page, read 22 October 2026.

The plugin's own advice sits at PHP 8.3 or greater, and 8.3 is one of the four branches php.net patched. A shop on PHP 8.1 or older is below what WooCommerce recommends and below what the PHP project still fixes. See our guide to checking and updating PHP on WordPress.

Check your PHP version in the WooCommerce Status report

1. Log in to your WordPress dashboard.
2. Open WooCommerce, then Status.
3. Scroll to the Server environment section.
4. Read the PHP version row.

WooCommerce's PHP guide gives the same path. You will see a number such as 8.3.36. The part after the second dot is the patch level, and the patched levels are the patched build on the shop's branch or newer.

A word of caution that php.net adds: Linux vendors received patches in advance and may fix PHP without changing the number on the screen. A low-looking number does not always mean no fix, and a current-looking one does not prove a fix. This is why you ask the host as well. WordPress itself lists it in Site Health, on the Info tab, in the Server block.

What to ask your host

WooCommerce's PHP guide says the host controls the PHP version, and you can usually change it from the hosting panel. Send a short message, and keep the reply. Our guide on what to ask your web host has a full email you can paste. For a shop, these questions matter most:

If you cannot update at once, php.net lists temporary measures, such as a fixed memory limit and a low upload size. It says they only reduce exposure, and the update is the real fix. Do not treat them as a long-term plan for a shop.

The payment gateway question

Many owners ask whether a PHP flaw puts card details at risk. We cannot answer that for your shop, and nobody can without knowing your setup. What we can say is that it depends on the gateway you use and how it is connected.

WooCommerce's documentation draws a few lines worth reading:

• Its security FAQ suggests using gateways that keep card data off your site, or that use tokens in place of card details.
• Its guide to payment card standards says the core WooCommerce plugin does not handle card data, and that compliance questions sit with the store owner.
• The same guide says hosted or off-site gateways can reduce what your site is responsible for, and that your payment processor may ask for a self-assessment or scans.

So the sensible step is to open your gateway's own security guidance, and write down how checkout works on your shop: does the customer type card details on your page, or on a page the gateway hosts? Then ask your gateway or processor what they expect from you after a server-level flaw. We do not make card compliance claims for any shop.

Before you update PHP on a shop

WooCommerce's PHP guide recommends a backup before you update. The rest of this list is our suggestion, based on general practice, and not a quote from WooCommerce.

1. Back up the files and the database. Keep a copy off the server, and check that you can find it.
2. Update the plugins first. Bring WordPress, WooCommerce, your theme and your extensions up to date. WooCommerce's security FAQ stresses keeping all of them current.
3. Check compatibility. WordPress.org mentions the PHP Compatibility Checker plugin for this.
4. Use a staging copy if your host offers one. Change the PHP version there first.
5. Pick a quiet time, and note how to switch back.

After you update PHP: test the shop

Do not stop at "the homepage loads". Run through what a customer does:

Check your error log, or ask the host to, for a day or two after the change. If something fails, switch PHP back, restore the backup if you have to, and then fix the plugin that caused it. Our guide to website maintenance costs shows where updates and testing sit among the recurring bills.

The honest alternatives

A shop does not have to live on PHP you manage. There are two ways out.

• Stay on WooCommerce, with a host that patches PHP. Managed WordPress hosting often updates PHP for you. Read our guide to WordPress site costs before you compare plans.
• Move to a hosted shop platform. Shopify is hosted, so there is no PHP version for you to patch. We found no Shopify statement about this advisory on 22 October 2026, so we cannot quote one. Our comparison of Shopify and WooCommerce for a growing store goes through costs, apps and control.

A move is a business decision about fees, features and your own time, and one security notice should not decide it alone.

How we help

For a WooCommerce shop we can check the PHP and plugin versions with you, set up a staging copy, update, and run the checkout tests above before anything reaches customers. If you would rather not run PHP at all, we build on Shopify and can move a store across. For other shop builds, see ecommerce development, and for WordPress itself, WordPress development.

Frequently asked questions

Does the PHP flaw affect WooCommerce?

WooCommerce runs on WordPress, which runs on the server's PHP, so a shop on an unpatched PHP version is exposed in the same way as any PHP site. WordPress.org says no WordPress update is needed, and the fix is a PHP update on the server.

Where do I find my PHP version in WooCommerce?

Go to WooCommerce, then Status, and scroll to the Server environment section. The PHP version row shows it. Site Health in WordPress shows it as well. Ask your host for the patch level to be sure.

Which PHP version does WooCommerce recommend?

WooCommerce's documentation lists PHP 8.3 or greater as the requirement and says it has been tested up to PHP 8.4. It says older versions may still run, but they are end of life and may expose a site to security risks.

Are my customers' card details at risk?

That depends on your gateway and how checkout is set up, and we cannot tell from outside. WooCommerce says the core plugin does not handle card data and that gateways differ. Read your gateway's security guidance, and ask them what to do after a server flaw.

Should I update PHP in the middle of the sales season?

The fix matters, so do not wait long. Use a staging copy if you can, back up first, and test checkout right after. If you cannot test safely, ask your host or a developer to do the update for you.

Is Shopify safer than WooCommerce for this?

Shopify is hosted, so there is no PHP for you to patch, though we found no Shopify statement on this advisory. That removes one task, and it comes with monthly fees and platform rules. See our Shopify and WooCommerce comparison before you decide.

What if I think the shop was hacked?

The NCSC tells anyone who stayed exposed to look for signs of compromise and planted backdoors, and to call an incident response provider if unsure. Tell your payment provider too, since they may have steps of their own.