PHP 8.6 and WordPress plugins: which popular plugins log deprecation notices

PHP 8.6 comes out on 19 November 2026. We ran the 100 most popular WordPress.org plugins (55,760 PHP files, latest releases on 28 October 2026) on the PHP 8.6.0RC4 release candidate. 39 of them use something PHP 8.6 deprecates, and 12 log a notice on an ordinary front-end page load. Nothing stops working, but the notices fill logs and show on pages wherever errors are displayed. Below: every plugin, file and line, and the one-line fix for each.

What a PHP 8.6 deprecation notice does, and what it doesn't

• Nothing stops working on PHP 8.6. A deprecation is a warning that the code will break in a future major version (PHP 9, no date yet). The plugin keeps working.
• It lands in your logs. With log_errors on (the usual hosting default) every notice goes to the PHP error log, and with WP_DEBUG_LOG to wp-content/debug.log.
• It can show on the page. If display_errors is on, or WP_DEBUG is on without WP_DEBUG_DISPLAY set to false, the notice is printed into the page. That breaks AJAX/JSON responses and can cause "headers already sent" warnings. Keep display off on live sites.
• Compile-time notices are logged when PHP compiles the file. With OPcache that happens once after a restart or cache reset, so you see a few lines, not one per visit. Function notices (spl_object_hash(), is_integer()…) are logged every time that code runs.

The 39 plugins with PHP 8.6 findings

"On a normal page load" means our WordPress 7.1.1 test site logged a PHP 8.6 deprecation from that plugin when we opened the home page or a post, with only that plugin active and its default settings.

One shared cause: Guzzle Promises' Is class

PHP 8.6 deprecates is as a class name. The Guzzle HTTP library's promises package has a class called Is, and its own code uses it, so PHP logs Deprecated: Using "is" as a class name is deprecated since 8.6 whenever a plugin makes an HTTP request through a bundled Guzzle. Guzzle fixed this on 18 October 2026: guzzlehttp/promises 2.6.0 and 3.1.0 use a new State class instead. These plugins still bundle an older copy: Yoast SEO, Site Kit by Google, UpdraftPlus, WP Mail SMTP by WPForms, Duplicator, Smush, W3 Total Cache, Google for WooCommerce, FluentSMTP, Forminator Forms. The fix for their authors is to update the bundled guzzlehttp/promises. Site owners can't patch it themselves; wait for the plugin update.

What PHP 8.6 deprecates that these plugins use

Smaller plugins: details

Redux Framework 4.5.16 (900,000+ installs)

• calls is_integer() / is_long(): Use is_int().

W3 Total Cache 2.11.0 (900,000+ installs)

• returns a value from a constructor: Change return …; inside __construct() to a bare return;. new always returns the object, so the value was never used.
• returns a value from a destructor: Change return …; inside __destruct() to a bare return;.
• calls spl_object_hash(): Use spl_object_id(), or update the bundled library that calls it.
• bundled Guzzle Promises Is class: This is the bundled Guzzle Promises library's Is class. Update the bundled guzzlehttp/promises to 2.6.0 or 3.1.0 (released 18 October 2026), which use the new State class internally.
• calls is_double(): Use is_float().

WPvivid 0.9.136 (900,000+ installs)

• calls is_integer() / is_long(): Use is_int().
• calls spl_object_hash(): Use spl_object_id(), or update the bundled library that calls it.

Fluent Forms 6.2.16 (800,000+ installs)

• calls spl_object_hash(): Use spl_object_id(), or update the bundled library that calls it.
• calls is_double(): Use is_float().

Google for WooCommerce 3.10.0 (800,000+ installs)

• calls spl_object_hash(): Use spl_object_id(), or update the bundled library that calls it.
• calls is_integer() / is_long(): Use is_int().
• calls is_double(): Use is_float().
• bundled Guzzle Promises Is class: This is the bundled Guzzle Promises library's Is class. Update the bundled guzzlehttp/promises to 2.6.0 or 3.1.0 (released 18 October 2026), which use the new State class internally.

WooCommerce PayPal Payments 4.2.0 (800,000+ installs)

• class constant named NAMESPACE: Rename the class constant (for example NAMESPACE to REST_NAMESPACE) and update the places that read it. PHP treats the name case-insensitively, so NAMESPACE counts.

Kadence Security 10.0.6 (700,000+ installs)

• returns a value from a constructor: Change return …; inside __construct() to a bare return;. new always returns the object, so the value was never used.

Joinchat 6.4.2 (700,000+ installs)

• class constant named NAMESPACE: Rename the class constant (for example NAMESPACE to REST_NAMESPACE) and update the places that read it. PHP treats the name case-insensitively, so NAMESPACE counts.

GTM4WP 2.0.6 (700,000+ installs)

• class constant named NAMESPACE: Rename the class constant (for example NAMESPACE to REST_NAMESPACE) and update the places that read it. PHP treats the name case-insensitively, so NAMESPACE counts.

FluentSMTP 2.4.1 (700,000+ installs)

• returns a value from a constructor: Change return …; inside __construct() to a bare return;. new always returns the object, so the value was never used.
• calls spl_object_hash(): Use spl_object_id(), or update the bundled library that calls it.
• bundled Guzzle Promises Is class: This is the bundled Guzzle Promises library's Is class. Update the bundled guzzlehttp/promises to 2.6.0 or 3.1.0 (released 18 October 2026), which use the new State class internally.

MainWP Child 6.3 (700,000+ installs)

• calls mbregex functions (mb_ereg_*): Use preg_replace() / preg_split() with the /u flag; mbregex is deprecated.
• calls spl_object_hash(): Use spl_object_id(), or update the bundled library that calls it.

Backuply 1.6.0 (600,000+ installs)

• returns a value from a constructor: Change return …; inside __construct() to a bare return;. new always returns the object, so the value was never used.
• calls is_integer() / is_long(): Use is_int().

Website Builder by SeedProd 6.20.10 (600,000+ installs)

• returns a value from a constructor: Change return …; inside __construct() to a bare return;. new always returns the object, so the value was never used.

Enable Media Replace 4.2.3 (600,000+ installs)

• returns a value from a constructor: Change return …; inside __construct() to a bare return;. new always returns the object, so the value was never used.

Forminator Forms 1.58.3 (600,000+ installs)

• calls spl_object_hash(): Use spl_object_id(), or update the bundled library that calls it.
• bundled Guzzle Promises Is class: This is the bundled Guzzle Promises library's Is class. Update the bundled guzzlehttp/promises to 2.6.0 or 3.1.0 (released 18 October 2026), which use the new State class internally.

Post Types Order 2.5.9 (600,000+ installs)

• returns a value from a constructor: Change return …; inside __construct() to a bare return;. new always returns the object, so the value was never used.

The Events Calendar 6.18.2 (600,000+ installs)

• class constant named NAMESPACE: Rename the class constant (for example NAMESPACE to REST_NAMESPACE) and update the places that read it. PHP treats the name case-insensitively, so NAMESPACE counts.
• returns a value from a constructor: Change return …; inside __construct() to a bare return;. new always returns the object, so the value was never used.
• calls is_integer() / is_long(): Use is_int().
• calls spl_object_hash(): Use spl_object_id(), or update the bundled library that calls it.

No PHP 8.6 findings (61 plugins)

Contact Form 7, Classic Editor, Akismet Anti-spam, All-in-One WP Migration and Backup, WPForms, Duplicate Page, Yoast Duplicate Post, Hostinger Tools, WPCode, Jetpack, Advanced Custom Fields, Classic Widgets, Ultimate Addons for Elementor, Redirection, WordPress Importer, WPS Hide Login, All-In-One Security, Starter Templates, Better Search Replace, Code Snippets, CookieYes, Custom Post Type UI, Disable Comments, Essential Addons for Elementor, XML Sitemap Generator for Google, Hostinger Reach, Image Optimizer, Loco Translate, Loginizer, MC4WP, Maintenance, One Click Demo Import, Popup Builder & Popup Maker for WordPress, Regenerate Thumbnails, AI Agent by SiteGround, Security Optimizer, SVG Support, Advanced Editor Tools, Spectra Legacy, WP Fastest Cache, File Manager, WP Multibyte Patch, WP-Optimize, Widgets for Google Reviews, WP Super Cache, Translate WordPress with GTranslate, Imagify Image Optimization, Polylang, Autoptimize, Breadcrumb NavXT, Cookie Compliance for WordPress, Flamingo, Smart Slider 3, WooPayments, Antispam Bee, User Role Editor, WooCommerce Stripe Payment Gateway, Click to Chat, Popup Maker, Premium Addons for Elementor, TablePress.

The full data (every finding with file, line and when it fires, as CSV and JSON) is on GitHub: php86-wordpress-plugin-deprecations (CC BY 4.0).

Check your own site

Free plugin: PHP Upgrade Readiness (zip, 21 KB). Install it on the site you want to check (Plugins → Add New → Upload Plugin), then open Tools → PHP Upgrade Readiness. It runs on your current PHP (7.4 or newer) and lists every plugin and theme with code that PHP 8.1 to 8.6 deprecate: file, line, the message PHP prints and the fix, plus a Site Health check and a CSV export. It reads files only and sends nothing anywhere. On these 100 plugins it reported every one of the 1,171 places the real PHP 8.6 flagged, and nothing else. Some notices only appear while code runs (for example is_a() called with a string), so also test on a staging copy:

Still on PHP 7.4, 8.0 or 8.1? The two critical flaws fixed on 21 October 2026 (CVE-2026-109618 and CVE-2026-109619) got new releases only for PHP 8.2 and newer; for older versions the PHP project points to your vendor or an upgrade (php.net advisory). Go to a patched 8.3 or 8.4 (8.2.35 is patched too, but PHP 8.2 ends on 31 December 2026). The plugin also checks the PHP 8.1, 8.2 and 8.3 deprecations you cross on the way.

1. When your host offers PHP 8.6, switch a staging copy first, with define( 'WP_DEBUG', true ); define( 'WP_DEBUG_LOG', true ); define( 'WP_DEBUG_DISPLAY', false ); in wp-config.php.
2. Click through the front end and wp-admin, then list the PHP 8.6 notices:

   grep "PHP Deprecated" wp-content/debug.log | grep -E "since 8\.6|from a constructor|called 'namespace'" | sort | uniq -c

3. Each line names the plugin folder. Look it up in the table above; if the plugin is not listed, send its author the line.
4. On the live site keep display_errors off; deprecations are warnings, not a reason to stay on old PHP.

How we tested (and what we didn't)

• The official PHP 8.6.0RC4 Windows build from php.net (checksum matched the page) and the current release of each plugin from WordPress.org on 28 October 2026.
• php -l on every PHP file finds compile-time deprecations wherever the file is. PHP 8.6's own tokenizer finds calls to deprecated functions; those only fire when that code runs (for example only during a backup, or only with one setting on).
• WordPress 7.1.1 with each plugin active alone and default settings: home page, a post, the wp-admin dashboard and plugins page as admin. Premium features, setup wizards, cron jobs and other admin screens were not exercised.
• RC4 is a release candidate; the final 8.6.0 on 19 November can still change. Deprecations from PHP 8.4 and 8.5 (already released) are not counted here.
• WordPress 7.1.1 core itself logged no PHP 8.6 deprecation on these pages.

Sources

• PHP 8.6 release schedule (GA 19 November 2026)
• php-src PHP-8.6 UPGRADING, section 4: Deprecated functionality
• RFC: Deprecations for PHP 8.6
• RFC: Deprecate returning a value from __construct()
• php.net pre-release builds (8.6.0RC4 used for this test)
• guzzlehttp/promises 2.6.0 / 3.1.0 changelog: Is deprecated, State added (18 October 2026)
• WordPress.org: popular plugins