PHP2Shell: keeping your WordPress site and Salesforce safe

23 October 2026

Two critical PHP security flaws, known as PHP2Shell, could affect any website built on WordPress. Here are four simple steps to check your server’s PHP version and update your plugins, plus what it means for your Salesforce connections.

PHP2Shell: keeping your WordPress site and Salesforce safe

You may have seen news this week about PHP2Shell, two critical security flaws in PHP. PHP is the programming language that WordPress (and most of the world’s websites) runs on, so if your website, donation page or event forms are built on WordPress, you could be affected and need to check it now.

There’s no need to panic. Fixes are already out, and for most organisations the update is quick and straightforward. Your web host or developer can usually take care of it for you, so the main thing is to check it’s been done.

Here’s what the Australian Cyber Security Centre and the software providers are recommending.

Four simple steps

  1. Update WordPress Server PHP Version. Check your version and ask your host to update it to the latest fixed one. You’ll find it in WordPress under Tools > Site Health > Info > Server. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
  2. Update all your plugins. Many plugins have known vulnerabilities, so this isn’t optional. If you use GiveWP, check you’re on version 4.16.7.2 or later, as older versions have a separate security flaw. Update Gravity Forms (version 3.1.1 or higher), WP-FormAssembly with REST API (version 3.0.0 or higher) and every other plugin to its latest version.
  3. Keep an eye out for anything unusual, such as admin users you don’t recognise or pages redirecting somewhere unexpected.
  4. If something doesn’t look right, report it to the Australian Cyber Security Centre at cyber.gov.au or on 1300 CYBER1 (1300 292 371).

What about Salesforce?

PHP2Shell isn’t a Salesforce flaw, and keeping your sensitive data in Salesforce rather than on your website already reduces your risk. The one thing to be aware of is that some WordPress plugins connect to Salesforce using login keys stored on the web server.

These include Gravity Forms with its Salesforce connection, the Account Engagement (Pardot) plugin, Object Sync for Salesforce, and donation forms custom-built on your website (rather than embedded forms from a platform like Raisely). 

If someone took control of an unpatched site, they could use those keys to reach your Salesforce data. Once your site is updated, it’s worth a quick check of which apps connect to your org, and resetting the keys for any site that may have been exposed.

Not sure what’s connected to your org, or want a hand checking? Get in touch with us and we’ll help!

More from Blaze

All News