Vulnerability CVE-2026-107663 in WP Toolkit on cPanel & WHM

Q: What is CVE-2026-107663?

It is a vulnerability in WP Toolkit on cPanel & WHM (CVE-2026-107663): an authenticated user may be able to place malicious files in a domain owned by another user on the same server. All WP Toolkit versions 6.11.4 and earlier are affected.

Q: Which version fixes CVE-2026-107663?

WP Toolkit 6.11.5. Per cPanel's advisory, affected versions are 6.11.4 and earlier and the patched version is 6.11.5 — this is the second WP Toolkit advisory in recent weeks, after CVE-2026-93699 (argument injection), so confirm you are on 6.11.5 or later.

Q: How do I update WP Toolkit to 6.11.5?

cPanel's advisory gives the direct command: log into the server via SSH and run bash

Q: How is this different from CVE-2026-93699?

CVE-2026-93699 was argument injection in WP Toolkit allowing code execution as other accounts; CVE-2026-107663 allows placing malicious files in another user's domain. Both are cross-account WP Toolkit issues fixed by updating — 6.11.5 covers the newer one, so ensure that version or later is installed.

CVE-2026-107663 is a vulnerability in WP Toolkit on cPanel & WHM affecting version 6.11.4 and earlier: an authenticated user may be able to place malicious files in a domain owned by another user on the same server. cPanel has released WP Toolkit 6.11.5 as the fix — update to it and confirm the patched version is running.

High 2026-10-13

cPanel Plesk

Was das unter einer SharedLicense-Lizenz bedeutet

Cross-account file placement lets one hosting customer plant malicious files — phishing pages, malware droppers — inside another customer's domain, damaging that account's reputation and potentially executing in its context.

Situation

A security vulnerability was discovered in WP Toolkit, which is provided with cPanel & WHM. This security vulnerability has been identified as CVE-2026-107663.

Affected product version

Product	Affected versions	Patched versions
WP Toolkit on cPanel & WHM	6.11.4 and earlier	6.11.5

Impact

An authenticated user may be able to place malicious files in a domain owned by another user on the same server.

Call to action

Update WP Toolkit to version 6.11.5 or later:

Log into the server via SSH
Run the following command to update WP Toolkit to version 6.11.5:

# bash <(curl https://wp-toolkit.plesk.com/cPanel/installer.sh || wget -O – https://wp-toolkit.plesk.com/cPanel/installer.sh) –version 6.11.5

How to confirm the patched version is installed

Log into the server via SSH and run the following command to check the installed WP Toolkit version:

# grep version /usr/local/cpanel/3rdparty/wp-toolkit/build.json

Make sure the version matches or is newer than the version in the Patched versions column above.

Häufig gestellte Fragen

What is CVE-2026-107663?

It is a vulnerability in WP Toolkit on cPanel & WHM (CVE-2026-107663): an authenticated user may be able to place malicious files in a domain owned by another user on the same server. All WP Toolkit versions 6.11.4 and earlier are affected.

Which version fixes CVE-2026-107663?

WP Toolkit 6.11.5. Per cPanel's advisory, affected versions are 6.11.4 and earlier and the patched version is 6.11.5 — this is the second WP Toolkit advisory in recent weeks, after CVE-2026-93699 (argument injection), so confirm you are on 6.11.5 or later.

How do I update WP Toolkit to 6.11.5?

cPanel's advisory gives the direct command: log into the server via SSH and run bash

How is this different from CVE-2026-93699?

CVE-2026-93699 was argument injection in WP Toolkit allowing code execution as other accounts; CVE-2026-107663 allows placing malicious files in another user's domain. Both are cross-account WP Toolkit issues fixed by updating — 6.11.5 covers the newer one, so ensure that version or later is installed.

Referenzen

Sicherheitshinweise

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen