WordPress Is Now a Liability for Business Owners: php2shell, Unpatchable Sites, and the True Cost of WordPress

By Jason Kelly - CEO

For almost twenty years, WordPress was the default answer to the question "How do I get a website?" It was free, it was everywhere, and every web designer in town knew how to install it. I understand why so many business owners still run on it. But I am going to be very direct with you in this article: in 2026, WordPress is no longer a safe default. For most small businesses, it has become a liability.

This is not a matter of taste or preference. The security news over the last few months has made it impossible to ignore, and the real cost of keeping a WordPress site alive is far higher than most owners realize.

The php2shell Problem

In October 2026, the Cybersecurity and Infrastructure Security Agency (CISA) issued an alert urging organizations to immediately patch two critical vulnerabilities in PHP itself, the programming language WordPress is built on. The flaws, nicknamed "php2shell," allow an attacker with no login at all to run their own commands on the server. CISA states that they affect all PHP installations serving web requests, and both were added to its Known Exploited Vulnerabilities catalog, which means criminals are already using them against real targets. CISA

Here is the part every business owner needs to read twice. CISA's guidance says that organizations that cannot update immediately, or that are still using PHP 8.1 or earlier, should take those systems offline until they can be patched or updated. In plain English: if your website runs on an old version of PHP, the federal government's advice is to unplug it.

A Huge Share of WordPress Sites Cannot Simply Be Patched

You might think, "My web guy will just click update." The problem is that a large portion of WordPress websites are running on versions of PHP that no longer receive security fixes at all. There is no patch to click.

Research from Censys, which examined more than 316,500 WordPress sites, found that only about 30% run a current version of PHP. The most common version they found was PHP 7.4, which reached end of life in November 2022. Only 31% of those sites were running an actively maintained version of WordPress core itself. Cyberpress

Think about what that means. Well over a third of WordPress websites are sitting on a foundation that cannot be fixed with an update. Getting them safe means upgrading PHP, which frequently breaks old themes and plugins, which then have to be repaired, replaced, or rebuilt. That is not maintenance. That is a renovation, and you are paying for it.

And it gets worse. More than half of reporting WordPress sites run PHP 8.2 or older, which loses security support after December 31, 2026. WP Developer

WordPress Core Itself Was Exploited in 2026

For years, the WordPress defense was, "Core is secure, it is only the plugins." That argument fell apart this year.

In July 2026, two chained vulnerabilities in WordPress core, known as "wp2shell," gave unauthenticated attackers full remote code execution on sites running versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. It was rated 9.8 out of 10 for severity, and exploitation was described as active and widespread. Bitdefender

Then in November 2026, CISA added another WordPress core flaw to its exploited list. This one is almost hard to believe: attackers can take over a site during the update process itself, because WordPress unpacks the new release into a predictable folder that the public can reach. The very act of updating your site opened the door. SC Media

When the update is the attack, you no longer have a technology you can trust.

The Plugin House of Cards

Most business WordPress sites run somewhere between twenty and forty plugins. A form plugin. A page builder. An SEO plugin. A caching plugin. A security plugin to protect you from the other plugins. Each one is written by a different developer, on a different schedule, with a different level of care.

Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, a 42% jump over the year before, and 91% of them were in plugins. Even more alarming, 46% had no fix available from the developer when they were made public. Patchstack The median time to mass exploitation was about five hours. Colorlib

Five hours. Your web designer is not watching your site at 2:00 in the morning. The bots are.

The True Cost of WordPress

When someone tells you WordPress is free, they are describing the download, not the ownership. Here is what owning a WordPress site actually costs.

Plugin and theme licenses. Premium forms, page builders, backups, SEO tools, and security firewalls are almost always yearly subscriptions. Add them up and many small businesses are paying hundreds or even thousands of dollars a year just to keep the features they already have.

Theme updates. Themes get updated, and when they do, custom changes can be wiped out or layouts can break. If your designer edited the theme directly, every update becomes a gamble.

Core file updates. WordPress core updates several times a year. Each one can conflict with a plugin, a theme, or the version of PHP on your server. And as we just saw, even the update process itself has been attacked.

The update roulette. Click update and hope the site still loads. When it does not, you get the famous blank white screen, a broken contact form, or a checkout that quietly stops working, and you usually find out from a customer.

Maintenance retainers. Many owners pay a monthly fee to have someone press the update buttons and restore a backup when something breaks. You are paying someone to babysit old technology.

Malware cleanup. When a site does get infected, cleanup can run hundreds to thousands of dollars. Patchstack's latest research with Monarx found that malware is getting harder to find and even harder to remove. Patchstack

The damage you cannot invoice. Google can flag a hacked site as dangerous. Browsers show warning screens. Ad accounts get suspended. Your email domain gets blacklisted. Customers who see a pharmacy spam page where your business used to be do not come back. That is the heartache, and it is the most expensive part of all.

Why a Full Stack Website Is the Smarter Choice

A modern full stack website is built differently from the ground up. There is no public PHP engine waiting to run whatever an attacker uploads. There is no pile of twenty to forty plugins written by strangers. There is no admin login page sitting at the same address on millions of sites for bots to hammer all day.

Pages are prepared ahead of time and served from fast, global hosting. The parts that need to do real work, like a contact form or a booking request, run as small, isolated functions instead of one giant program with access to everything. That means:

• No plugin updates to babysit.
• No theme updates breaking your layout.
• No core file updates that can be hijacked.
• Faster load times, which Google rewards and customers notice.
• Clean code that your agency actually controls.

I wrote earlier about why traditional WordPress websites are going obsolete. This year's security news has only proven that point faster than I expected.

Why Wait Months for Outdated Technology?

Here is the part that honestly frustrates me. Business owners are still being told to wait four, six, even eight weeks for a web designer to deliver a WordPress site. They pay thousands of dollars, wait two months, and then receive a technology that needs updates on day one, depends on plugins that may already have open vulnerabilities, and sits on a PHP foundation that the federal government is warning people about.

Why would you wait a month or two for an outdated, expensive product?

At Phoenix Custom Websites, you can have a website up in less than 60 seconds. From there, our staff handles the final touches with a 24 hour turnaround, so you get a professional, modern, full stack website without the waiting, the plugins, or the heartache.

Final Thoughts

WordPress had a great run. It helped millions of businesses get online. But technology moves forward, and the businesses that win are the ones that move with it. In 2026, running your business website on WordPress means accepting a constant stream of updates, licenses, maintenance bills, and security risks that simply do not need to exist anymore.

If you are running a WordPress site today and want to know where you stand, call me directly at (602) 641-8210 or email jason@phoenixazadagency.com. We will look at your site honestly and tell you what it would take to move it to something faster, safer, and built for the way the web works now.

Sincerely, Jason

Research and References

1. CISA. "Critical Vulnerabilities in PHP Require Immediate Patching." October 2026. https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
2. Cyberpress, reporting Censys research. "WordPress Sites Running EOL PHP Face Defacement and Plugin Exploit Risks." July 2026. https://cyberpress.org/wordpress-sites-running-eol-php/
3. Bitdefender. "Technical Advisory: wp2shell, Unauthenticated Remote Code Execution and Full Site Takeover in WordPress Core." July 2026. https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-wp2shell-unauthenticated-remote-code-execution-full-site-takeover-wordpress-core
4. SC Media. "WordPress Core bug added to CISA's exploited vulnerabilities list." November 2026. https://www.scworld.com/news/wordpress-core-bug-added-to-cisas-exploited-vulnerabilities-list
5. Patchstack. "State of WordPress Security in 2026." February 2026. https://patchstack.com/whitepaper/state-of-wordpress-security-in-2026/
6. WP Developer. "WordPress Security Statistics 2026." October 2026. https://wpdeveloper.ca/blog/wordpress-security-statistics