If your WordPress site is running PHP 8.1 or older right now, a hacker can take control of it without ever knowing your password.
That is not a hypothetical. It is an active vulnerability in PHP itself, the software that powers roughly 70% of websites on the internet. Researchers found it with the help of an AI tool, a security patch has been released, and most reputable hosting companies have already applied it to their servers.
But here is the catch that most site owners will not find out about until something goes wrong. The fix only covers PHP 8.2 and newer. If your site is still running on 8.1 or any older version, that patch does not apply to you. Your site is still exposed.
So the first thing to do right now is check your PHP version.
Log into your hosting control panel, which is usually cPanel, Plesk, or a custom dashboard depending on your host, and look for a PHP version selector. It is generally under a section labelled Software or PHP Configuration. If you see 8.1 or anything lower, that is the problem you need to fix.
Before you switch PHP versions, update everything in WordPress first. Go into your WordPress dashboard and update WordPress core, then your theme, then every plugin. Do this in that order. Updating PHP on a site running outdated plugins is a good way to break things, so get everything current first, then make the switch to PHP 8.2 or higher.
If something breaks after you upgrade PHP, it almost always means a theme or plugin that has not been maintained is incompatible with the newer version. At that point you have a few options. You can look for a replacement plugin that does the same job and is actively maintained. You can contact your host and ask them to help identify what broke. Or, and this is where things have changed significantly in the last couple of years, you can use an AI tool to rewrite the broken parts.
I used AI to audit my own sites for security issues during this process and we found a few things that are now patched. AI tools are genuinely useful for this kind of work, particularly for fixing plugins that have been abandoned by their original developers but that you still rely on. When you do use AI to rewrite or patch plugin code, ask the tool, or a separate one, to review the completed code specifically for security vulnerabilities before you do anything else with it. And always test changes on a staging copy of your site first, never directly on the live version.
If any of this feels outside your comfort zone, call your host. A decent hosting company will tell you your PHP version and walk you through upgrading it. If yours is not willing to do that, it is worth asking whether you have the right host.
The boring reality of running a website is that keeping your software current is one of the most important things you can do, and it is also one of the least interesting. Nobody thinks much about it until a site goes down or gets hijacked. This vulnerability is a good reminder that the maintenance tasks that feel tedious are usually the ones holding everything else together.
Security is the foundation. Once that foundation is solid, everything you do to build traffic and generate income from your site actually has somewhere to land.
If you want to work on the income side of things, everything you need to do to make sales is here: