Volver a los avisos de seguridad

Vulnerability CVE-2026-107663 in WP Toolkit on cPanel & WHM

CVE-2026-107663 is a vulnerability in WP Toolkit on cPanel & WHM affecting version 6.11.4 and earlier: an authenticated user may be able to place malicious files in a domain owned by another user on the same server. cPanel has released WP Toolkit 6.11.5 as the fix — update to it and confirm the patched version is running.

High
cPanel Plesk

Lo que esto significa bajo una licencia de SharedLicense

Cross-account file placement lets one hosting customer plant malicious files — phishing pages, malware droppers — inside another customer's domain, damaging that account's reputation and potentially executing in its context.

Situation

A security vulnerability was discovered in WP Toolkit, which is provided with cPanel & WHM. This security vulnerability has been identified as CVE-2026-107663.

Affected product version

Product Affected versions Patched versions
WP Toolkit on cPanel & WHM 6.11.4 and earlier 6.11.5

Impact

An authenticated user may be able to place malicious files in a domain owned by another user on the same server.

Call to action

Update WP Toolkit to version 6.11.5 or later:

  1. Log into the server via SSH

  2. Run the following command to update WP Toolkit to version 6.11.5:

    # bash <(curl https://wp-toolkit.plesk.com/cPanel/installer.sh || wget -O – https://wp-toolkit.plesk.com/cPanel/installer.sh) –version 6.11.5

How to confirm the patched version is installed

Log into the server via SSH and run the following command to check the installed WP Toolkit version:

# grep version /usr/local/cpanel/3rdparty/wp-toolkit/build.json

Make sure the version matches or is newer than the version in the Patched versions column above.

Preguntas frecuentes

What is CVE-2026-107663?
It is a vulnerability in WP Toolkit on cPanel & WHM (CVE-2026-107663): an authenticated user may be able to place malicious files in a domain owned by another user on the same server. All WP Toolkit versions 6.11.4 and earlier are affected.
Which version fixes CVE-2026-107663?
WP Toolkit 6.11.5. Per cPanel's advisory, affected versions are 6.11.4 and earlier and the patched version is 6.11.5 — this is the second WP Toolkit advisory in recent weeks, after CVE-2026-93699 (argument injection), so confirm you are on 6.11.5 or later.
How do I update WP Toolkit to 6.11.5?
cPanel's advisory gives the direct command: log into the server via SSH and run bash
How is this different from CVE-2026-93699?
CVE-2026-93699 was argument injection in WP Toolkit allowing code execution as other accounts; CVE-2026-107663 allows placing malicious files in another user's domain. Both are cross-account WP Toolkit issues fixed by updating — 6.11.5 covers the newer one, so ensure that version or later is installed.

Referencias

Avisos de seguridad

Avisos relacionados

EasyApache 4 25.91 — cPanel & WHM Update

2026-10-21

EasyApache 4 25.92 — cPanel & WHM Update

2026-10-21

cPanel CVE-2026-110672

2026-10-19 00:00:00

Comprueba tu sistema en busca de vulnerabilidades

Selecciona tu producto y sistema operativo para ver los comandos de corrección exactos que se aplican a ti.

Comprueba tu sistema