WordPress on nginx and PHP-FPM
Websites, blogs and small online shops on WordPress, with nginx in place of Apache as the web server.
Open It in the StackIts Layers
nginx takes the requests and passes the PHP ones to PHP-FPM, which runs WordPress on PHP. The site keeps its posts in MySQL.
The stack runs from the top layer down, as on the topic page. Each layer shows its technology, and the badge beside it says who runs and patches it.
Who Runs What
On your own server or a cloud virtual machine, every layer shown is yours, from WordPress, nginx, PHP-FPM and PHP to MySQL and Linux. A managed WordPress host runs and patches everything beneath WordPress, while you keep WordPress, its plugins and its themes up to date.
- You
- Your team runs it and installs its updates.
Where Its Code Comes From
Plugins and themes bring in most of the outside code, and each one runs with full control of the site. Many of them bundle Composer packages from Packagist. The server's own software, nginx and PHP-FPM included, comes from the Linux distribution's packages, and pages often load scripts from CDNs, the content delivery networks that serve shared files.
Well-Known Flaws in Its Layers
These are well-known flaws in the technologies this stack is built from. Each CVE id links to its advisory, and the technology's own page says how far that flaw reached.
CVE-2019-11043 (opens in a new tab)2019
PATH_INFO Underflow, in PHP-FPM
With a common nginx set-up, a crafted web address made PHP-FPM write outside its buffer, which let attackers run code.
CVE-2026-109618 (opens in a new tab)and CVE-2026-1096192026
PHP2Shell, in PHP
Two flaws in how PHP cleans up memory after a request is cut short let an attacker who had not signed in run code. Each scores 9.2 out of 10 on CVSS v4.0, the common scale for how severe a flaw is.
Fixed on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
CVE-2024-4577 (opens in a new tab)2024
PHP CGI Argument Injection, in PHP
On Windows, PHP running as CGI could be tricked into running attacker code.
CVE-2016-5195 (opens in a new tab)2016
Dirty COW, in Linux
A race condition in the Linux kernel let a local user gain root.