In the vast ecosystem of WordPress, where millions of websites power everything from personal blogs to enterprise applications, the underlying technology stack often remains out of sight and out of mind for the average user. While content creators and site owners frequently interact with the visual dashboard, plugins, blocks, and themes, the foundational programming language driving the platform—PHP—often goes unnoticed until a version update notification appears.
On a recent episode of the Jukebox Podcast from WP Tavern, host Nathan Wrigley sat down with Milan Petrović, a full-stack developer at Freemius and a veteran of the WordPress space since 2007, to discuss the critical risks associated with legacy PHP code. Recorded live at WordCamp Europe, the conversation delved into Petrović’s presentation, titled "Secure by Design: Hardening Plugins with PHP 8.x," and examined why clinging to outdated PHP versions is no longer just a minor technical debt, but an active invitation for automated exploitation.
The Evolution and Stagnation of PHP in WordPress
Having spent nearly two decades developing plugins—particularly for expanding bbPress forums—and running his own plugin development company, Dev4Press, Petrović has witnessed firsthand the dramatic shifts in both the WordPress and PHP landscapes. When Petrović transitioned to the Freemius team as a full-stack developer in 2024, it marked a new chapter in a long career deeply intertwined with open-source software.
During their discussion, Wrigley and Petrović addressed the fundamental tension at the heart of WordPress: its legendary commitment to backwards compatibility. From the earliest days of the platform, supporting older software versions allowed for rapid and widespread adoption. Website owners did not need to upgrade their servers annually, and hosting companies could provide affordable WordPress hosting without investing heavily in the latest server infrastructure.
However, this policy of universal accommodation has created a double-edged sword. While it lowered the barrier to entry for millions of users, it also left core software and a vast ecosystem of plugins tethered to obsolete environments. Petrović pointed out that WordPress Core still maintains compatibility with PHP 7.4—a version that reached its official end-of-life more than four years ago.
The Alarming Reality of Outdated Software
For non-technical users, the debate over PHP version numbers can seem abstract. Websites load, forms submit, and business continues as usual, leading to a pervasive mindset of "if it isn’t broken, don’t fix it." Petrović, however, drew back the curtain on the alarming security implications of maintaining legacy environments.
When researching statistics for his WordCamp Europe presentation, Petrović uncovered a startling reality: thousands of open, confirmed bug reports exist for PHP 7 and PHP 5 branches. Because these legacy versions are no longer actively supported or patched by the official PHP development team, those vulnerabilities will never be fixed. Millions of WordPress sites continue to operate on these unsupported versions, effectively exposing themselves to thousands of known bugs. Many of these flaws are directly related to security, creating automated exploitation targets for malicious actors scanning the web for unpatched servers.
While some hosting companies attempt to bridge the gap by building their own custom PHP patches for legacy versions, Petrović cautioned that this introduces a new set of unpredictable variables. Running custom builds can cause core files and plugins to behave in unexpected ways, potentially opening doors to undocumented vulnerabilities. For Petrović and security-minded developers, relying on official, supported PHP releases remains the safest path forward.
Performance Gains and the Case for PHP 8
Beyond security, upgrading to modern PHP versions offers massive performance advantages that benefit site owners, developers, and hosting providers alike. Each new iteration of PHP brings compounding efficiency improvements. According to Petrović, PHP 8.5 delivers performance that is more than 50 percent faster than PHP 7.4, accompanied by a drastic reduction in memory usage for the exact same block of code.
For hosting companies managing dense server environments, these performance metrics translate directly into conserved resources and reduced operational costs. Despite these clear benefits, broad adoption across the broader web hosting industry remains uneven. While managed WordPress hosts often enforce stricter minimum PHP requirements—pushing users toward modern branches like PHP 8.2 or 8.3—budget hosting tiers frequently continue supporting outdated versions to prevent breaking legacy sites for non-technical customers.
Petrović emphasized that WordPress itself must play a proactive leadership role in accelerating this transition. By eventually phasing out support for legacy branches and declaring PHP 8 as a mandatory minimum requirement, the project could spur developers and hosting providers to modernize their infrastructure more aggressively. While such a shift would undoubtedly cause friction for abandoned plugins and static sites, continuing to support decade-old software indefinitely leaves the entire ecosystem vulnerable.
Demonstrating Exploits with the Vulnerability Lab Plugin
To help developers visualize the tangible impact of outdated code, Petrović introduced a custom tool he developed specifically for his WordCamp presentation: the Vulnerability Lab plugin. Available on GitHub, the plugin is designed to demonstrate how common exploits—such as authentication bypasses and server-side request forgery—play out across different PHP versions.
Rather than relying purely on theoretical warnings, the Vulnerability Lab plugin allows developers to run identical pieces of code in legacy environments versus modern PHP environments to observe the stark contrasts in behavior. In legacy setups, insecure patterns may result in fatal errors or successful exploits, whereas modern PHP versions leverage native architectural shields to neutralize the threats automatically. Petrović noted that the tool also highlights memory consumption differences side-by-side, offering a compelling visual argument for agencies trying to convince reluctant clients to modernize their tech stacks.
Despite the powerful safety mechanisms introduced in modern PHP, Petrović stressed that upgrading the server environment does not eliminate the need for diligent coding practices. Core WordPress security features—such as proper data sanitization, escaping, and robust architectural patterns—remain vital components of a secure website. Modern PHP acts as a powerful native shield, but it must work in tandem with secure plugin development and disciplined maintenance routines.
As the WordPress community looks toward future releases, the conversation around legacy code highlights a collective challenge: balancing accessibility with safety. For developers, hosting providers, and site administrators alike, the message from Milan Petrović is clear. Treating a website like a static, maintenance-free asset is a risky gamble, and embracing modern PHP versions is no longer merely a best practice, but an essential step toward building a resilient, high-performing digital future.
