Tell them to take anything with PHP offline, so that it isn't available from the public internet. That is how Netcup and Contabo are handling Wordpress hosting until they've upgraded all affected packages.

There are already functional exploit scripts on GitHub, you can target any Wordpress site right now.