PHP Security Update: What WordPress and CourseGlade Users Need to Know

Two critical vulnerabilities were recently disclosed in PHP, the server-side runtime used by WordPress websites and many other web applications.

If you run a WordPress website with CourseGlade, there is an important distinction to understand: these vulnerabilities are in PHP itself—not in WordPress or the CourseGlade plugin. That means a WordPress or CourseGlade update is not the fix for this specific issue.

The fix needs to be applied at the server level.

What happened?

The PHP project released security updates for two critical vulnerabilities. Under certain conditions, these issues could allow an unauthenticated attacker to execute code on an affected server.

The patched PHP releases are:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

You can read the technical details in the PHP Foundation security release and the WordPress security notice.

Does this affect WordPress or CourseGlade?

No. The vulnerabilities were found in the PHP runtime, not in WordPress or CourseGlade code. No WordPress or CourseGlade update is required for this specific PHP security issue.

However, this does not mean that every WordPress or CourseGlade website is automatically protected. If your server is running an unpatched PHP version, the website may still be exposed even when WordPress and all plugins are up to date.

CourseGlade runs as a WordPress plugin, so it depends on the security of the hosting environment where WordPress is installed. The plugin itself cannot patch the PHP runtime.

How to check your PHP version in WordPress

You can check the PHP version reported by your WordPress installation from the admin area:

1. Open WP Admin.
2. Go to Tools → Site Health.
3. Open the Info tab.
4. Expand the Server section.
5. Check the PHP version listed there.

Compare the version with the patched releases above. If you are unsure whether your hosting provider has backported the security fix to an older PHP branch, ask your host to confirm the patch status.

What should you do if PHP is not patched?

Contact your hosting provider or server administrator and ask them to update PHP to a supported, patched release.

Depending on your hosting setup, you may be able to update PHP from:

• Your hosting control panel
• A managed WordPress dashboard
• Your server management panel
• Your server administrator or hosting support team

Before making a major PHP version change, take a recent backup and test the update on a staging site when possible. After the update, check your WordPress dashboard, courses, student enrollment, payments, quizzes, assignments, and other important workflows.

If your site is using an outdated PHP branch that no longer receives security updates, ask your host about moving to a supported branch. The PHP project no longer provides security support for PHP versions older than 8.2.

What CourseGlade users should know

CourseGlade does not patch PHP at the plugin level. Keeping your website secure requires several layers of maintenance:

• Keep PHP updated at the server level.
• Keep WordPress, your theme, and plugins updated.
• Use a reputable hosting provider.
• Maintain regular backups.
• Use strong administrator passwords and two-factor authentication where available.
• Review your hosting provider’s security notifications.

CourseGlade can be used on a patched WordPress hosting environment, but the hosting environment remains the site owner’s responsibility. If you manage an online academy, ask your host to confirm that your PHP installation includes the latest security fixes.

Final takeaway

This is a PHP security update—not a WordPress or CourseGlade plugin update. Updating WordPress and CourseGlade is still important for general security, but it will not replace the server-level PHP fix required for these vulnerabilities.

Check your PHP version today. If it is not patched, contact your hosting provider before continuing to run your academy on an exposed server.

For more information, see the official WordPress announcement, the PHP Foundation advisory, and the ENISA joint statement.