Tell them to take anything with PHP offline, so that it isn't available from the public internet. That is how Netcup and Contabo are handling Wordpress hosting until they've upgraded all affected packages.

There are already functional exploit scripts on GitHub, you can target any Wordpress site right now.

Shut the sites down until you are able to update to the latest PHP patch for your version.

You need to update the PHP version, which is usually done by the hosting provider.