Vulnerability CVE-2026-107663 in WP Toolkit on cPanel & WHM

Situation

A security vulnerability was discovered in WP Toolkit, which is provided with cPanel & WHM. This security vulnerability has been identified as CVE-2026-107663.

Affected product version

Impact

An authenticated user may be able to place malicious files in a domain owned by another user on the same server.

Call to action

Update WP Toolkit to version 6.11.5 or later:

1. Log into the server via SSH

2. Run the following command to update WP Toolkit to version 6.11.5:

   # bash <(curl https://wp-toolkit.plesk.com/cPanel/installer.sh || wget -O - https://wp-toolkit.plesk.com/cPanel/installer.sh) --version 6.11.5

How to confirm the patched version is installed

Log into the server via SSH and run the following command to check the installed WP Toolkit version:

# grep version /usr/local/cpanel/3rdparty/wp-toolkit/build.json

Make sure the version matches or is newer than the version in the Patched versions column above.