WordPress core and plugin updates patch WordPress. They do not replace php-fpm or mod_php. A fully updated WordPress site on PHP 7.4 is still a PHP2Shell question.
What to look at
The site health page and a phpinfo file can show a version, and both can be wrong if a cache or a different vhost answered. Prefer the pool socket from the web server config. Hosts often select PHP in a panel. That selector is the package you ask the host to patch.
Remediation
Ask the host which PHP package and SAPI serve this account, whether a vendor advisory covers it, and when the workers will restart. If you run the server, follow the distribution guide. Legacy WordPress that requires PHP 5.6 or 7.x is a consulting case: secure the runtime you can, and plan the application move without claiming a same-day core upgrade fixes the CVE.
Nginx or Apache in front of WordPress is still only the proxy or the module loader. Follow the web server guide that matches the handler you found. Temporary PHP settings remain incomplete if the provider cannot patch this week. CISA’s 21 October 2026 alert said internet-facing PHP that cannot be updated should be taken offline until it can. That is a business decision for a store or a campus site, and it is the alternative to pretending the application update was enough.
Questions
Does updating WordPress fix PHP2Shell?
No. WordPress runs on PHP. The PHP binary or package that serves it has to be patched or replaced.