WordPress on Linux, Apache, MySQL and PHP

Its Layers

This is the classic LAMP stack, with PHP running inside Apache. Most WordPress flaws are in plugins and themes, not the core.

The stack runs from the top layer down, as on the topic page. Each layer shows its technology, and the badge beside it says who runs and patches it.

Who Runs What

On a hosting plan, the host runs Linux, Apache, PHP and MySQL and keeps them patched, while you run WordPress, its plugins and its themes. On your own server or a cloud virtual machine, every layer shown here is yours.

You

Your team runs it and installs its updates.

Your Host

A hosting or cloud provider runs it and patches it for you.

Where Its Code Comes From

Plugins and themes bring in most of the outside code, and each one runs with full control of the site. Many of them bundle Composer packages from Packagist. The server's own software comes from the Linux distribution's packages, and pages often load scripts from CDNs, the content delivery networks that serve shared files.

• WordPress Plugins
• Packagist
• OS Packages
• Scripts From a CDN

Well-Known Flaws in Its Layers

These are well-known flaws in the technologies this stack is built from. Each CVE id links to its advisory, and the technology's own page says how far that flaw reached.

• CVE-2021-41773 (opens in a new tab)2021

  Path Traversal, in Apache HTTP Server

  In Apache 2.4.49, this flaw could expose unprotected files and, with CGI enabled, run code.

• CVE-2026-109618 (opens in a new tab)and CVE-2026-1096192026

  PHP2Shell, in PHP

  Two flaws in how PHP cleans up memory after a request is cut short let an attacker who had not signed in run code. Each scores 9.2 out of 10 on CVSS v4.0, the common scale for how severe a flaw is.

  Fixed on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

• CVE-2024-4577 (opens in a new tab)2024

  PHP CGI Argument Injection, in PHP

  On Windows, PHP running as CGI could be tricked into running attacker code.

• CVE-2016-5195 (opens in a new tab)2016

  Dirty COW, in Linux

  A race condition in the Linux kernel let a local user gain root.

Sources

• WordPress: requirements (opens in a new tab)
• Microsoft Learn: shared responsibility in the cloud (opens in a new tab)