Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026. Rated 9.2 out of 10, they reportedly enable unauthenticated remote code execution. Because WordPress runs on PHP, sites using vulnerable PHP versions may be exposed; the issue is in the server runtime, not WPBakery itself.

The PHP project has issued patched releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Remediation therefore depends first on the hosting environment: site owners or their providers need to update PHP, then verify that WordPress core, themes and plugins remain current and compatible. A complete files-and-database backup should precede the changes. Updating WPBakery is part of routine compatibility maintenance, but does not substitute for patching PHP.

WPBakery 9.1, scheduled for October 2026, is expected to require PHP 8.2.35 or later, setting a minimum aligned with the patched release. Direct license holders with active support or Support Plus can use automatic updates; other direct license holders can download the release from the Customer Center. Websites receiving WPBakery through a theme may need a separate direct license for access. Author of the original text: Raitis Sevelis (WPBakery)