Vulnerability CVE-2026-107663 in WP Toolkit on cPanel & WHM
CVE-2026-107663 is a vulnerability in WP Toolkit on cPanel & WHM affecting version 6.11.4 and earlier: an authenticated user may be able to place malicious files in a domain owned by another user on the same server. cPanel has released WP Toolkit 6.11.5 as the fix — update to it and confirm the patched version is running.
SharedLicense लाइसेंस के तहत इसका अर्थ
Cross-account file placement lets one hosting customer plant malicious files — phishing pages, malware droppers — inside another customer's domain, damaging that account's reputation and potentially executing in its context.
Situation
A security vulnerability was discovered in WP Toolkit, which is provided with cPanel & WHM. This security vulnerability has been identified as CVE-2026-107663.
Affected product version
| Product | Affected versions | Patched versions |
|---|---|---|
| WP Toolkit on cPanel & WHM | 6.11.4 and earlier | 6.11.5 |
Impact
An authenticated user may be able to place malicious files in a domain owned by another user on the same server.
Call to action
Update WP Toolkit to version 6.11.5 or later:
- Log into the server via SSH
-
Run the following command to update WP Toolkit to version 6.11.5:
# bash <(curl https://wp-toolkit.plesk.com/cPanel/installer.sh || wget -O – https://wp-toolkit.plesk.com/cPanel/installer.sh) –version 6.11.5
How to confirm the patched version is installed
Log into the server via SSH and run the following command to check the installed WP Toolkit version:
# grep version /usr/local/cpanel/3rdparty/wp-toolkit/build.json
Make sure the version matches or is newer than the version in the Patched versions column above.
अक्सर पूछे जाने वाले प्रश्न
What is CVE-2026-107663?
Which version fixes CVE-2026-107663?
How do I update WP Toolkit to 6.11.5?
How is this different from CVE-2026-93699?
अपने सिस्टम में भेद्यताओं की जाँच करें
अपना उत्पाद और ऑपरेटिंग सिस्टम चुनें ताकि आपके लिए लागू सटीक फिक्स कमांड देख सकें।
अपना सिस्टम जाँचें