PHP & WordPress Security in 2026: What a "Human-Built" Score Doesn’t Tell You
Our own human/CMS counter-signals are some of the strongest evidence in the detector: finding a WordPress meta name="generator" tag, a reference to the standard WordPress content or core include directories, or even a bare server-rendered .php link subtracts 30–40 points from the AI score, on the reasoning that a classic PHP-rendered CMS stack is a strong sign of a human-run site. That reasoning still holds. What it doesn't mean is that the site is safe. Two WordPress core vulnerabilities patched in 2026 are a useful reminder of why those are separate questions.
wp2shell: a pre-auth RCE chain (July 2026)
Tracked as CVE-2026-60137 and CVE-2026-63030, this was a pair of flaws in WordPress core — one a SQL injection issue, the other a REST API batch-route confusion bug — that could be chained by an attacker with no account at all to execute code on the server. It affected WordPress 6.8.0–6.8.5, 6.9.0–6.9.4, and 7.0.0–7.0.1, fixed in 6.8.6, 6.9.5, and 7.0.2 respectively, released July 17, 2026. Public proof-of-concept exploits appeared quickly after disclosure, and WordPress pushed forced auto-updates — though those don't reach installs that had auto-updates disabled, which is exactly the kind of site our detector would otherwise score as reassuringly "human-built."
XSS2Shell: login-screen XSS to code execution (August 2026)
CVE-2026-64638, a CVSS 8.9 flaw in how the log parameter on the WordPress login screen is sanitized, allowed a reflected cross-site scripting attack that — if a logged-in administrator could be lured into clicking a crafted link — escalated to PHP code execution. It was patched in WordPress 7.0.3 on August 6, 2026, with the fix backported across every maintained security branch back to 4.7. Unlike wp2shell, exploitation here needs a human to be tricked, but the underlying XSS itself requires no login at all.
Why this matters for how you read our score
A low AI score from us is a statement about how a page was built, not a security audit. A site running classic WordPress — the single strongest "human-built" signal we check for — is, by definition, running a large, popular PHP codebase that is a constant, active target. Our detector has no way to know which WordPress version a site is running, whether it's patched, or whether auto-updates are even enabled. That's outside what a static HTML check can tell you, the same way it can't tell you whether a hand-coded site has its own unpatched dependencies.
If your own site runs WordPress, the practical takeaway is simple and unrelated to anything we can detect: confirm you're on 6.8.6, 6.9.5, or 7.0.3 or later (7.0.2 alone isn't enough — XSS2Shell came after it), and don't rely on auto-updates being on without checking.
Sources: Help Net Security, Security Affairs, and coverage of the 7.0.3 security release. We haven't independently verified every detail — check the official WordPress.org security release notes for authoritative version ranges before acting.
See exactly what our human/CMS counter-signals check for on the methodology page, or run a scan of your own.