{"id":27717,"date":"2026-09-29T14:14:07","date_gmt":"2026-09-29T13:14:07","guid":{"rendered":"https:\/\/www.heartinternet.uk\/blog\/?p=27717"},"modified":"2026-09-29T14:39:44","modified_gmt":"2026-09-29T13:39:44","slug":"weekly-cybersecurity-summary-22-september-to-28-september-2026","status":"publish","type":"post","link":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-22-september-to-28-september-2026\/","title":{"rendered":"Weekly Cybersecurity Summary \u2014 22 September to 28 September 2026"},"content":{"rendered":"[vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_padding=”2%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_padding=”2%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”`{`Critical`}` Addify Request a Quote for WooCommerce Unauthenticated File Upload (CVE-2026-18143)” text_direction=”default”][\/split_line_heading][divider line_type=”Full Width Line” line_thickness=”3″ divider_color=”default”][vc_column_text css=”” text_direction=”default”]A vulnerability published on 26 September 2026 in Addify’s Request a Quote for WooCommerce plugin allows any visitor, without logging in, to upload a file of their choosing through the plugin’s quote pop-up form. The form handler does not check the type or extension of uploaded files, so an attacker can upload a PHP script and then run it on the server. The issue was reported by the researcher t4g0 and published through Wordfence. At the time of writing, no fixed version had been documented. The plugin is sold through the WooCommerce marketplace rather than WordPress.org, which means it may not update automatically in the way many free plugins do.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-exclamation-triangle” icon_size=”20″ min_height=”120″]\n

Affected: <\/strong><\/h4>\n

Request a Quote for WooCommerce (Addify), versions up to and including 2.9.2.[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-check” icon_size=”20″ min_height=”120″]\n

Fixed version: <\/strong><\/h4>\n

None documented at the time of writing.[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-star” icon_size=”20″ min_height=”120″]\n

CVSS: <\/strong><\/h4>\n

9.8 (Critical).[\/fancy_box][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”What This Means For You:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]The Heart Internet Team are aware of several security issues affecting web hosting infrastructure this week, and we want to help customers understand what they mean, who may be affected, and what sensible steps to take. This week we are covering three issues: an unpatched file upload flaw in a WooCommerce quote plugin, a critical code execution issue in the widely used Drupal Webform module, and a cPanel flaw that lets any hosting account run code as root. The common thread is that each one can be reached from a website or a hosting account that looks entirely ordinary, so keeping software up to date remains the most effective defence.[\/vc_column_text][vc_column_text css=”” text_direction=”default”]Shared hosting: On shared hosting, a successful attack gives the attacker control of the affected WordPress site and everything stored in that hosting account, including order and contact details held in the shop.<\/p>\n

VPS and dedicated servers: On a VPS or dedicated server, the attacker gains code execution as the web server user, which can be used as a starting point to attack the rest of the server.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Recommended Action:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]If this plugin is installed, deactivate it until a fixed version is released and check its upload folder for unexpected .php files. Where the quote feature is essential, ask your developer to block PHP execution in the plugin’s upload directory as a temporary measure.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_padding=”2%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”`{`Critical`}` Drupal Webform Remote Code Execution (CVE-2026-96355, SA-CONTRIB-2026-175)” text_direction=”default”][\/split_line_heading][divider line_type=”Full Width Line” line_thickness=”3″ divider_color=”default”][vc_column_text css=”” text_direction=”default”]On 23 September 2026, the Drupal Security Team published 22 coordinated advisories for Webform, one of the most widely used Drupal modules for building forms. The most serious, SA-CONTRIB-2026-175, affects forms that use a custom format for fields that accept multiple values. Webform did not exclude those formats from token replacement, so text submitted by a visitor could be treated as template code when the submission was displayed. Depending on the site’s configuration and other enabled modules, this can lead to information disclosure, stored cross-site scripting or remote code execution. The Drupal Security Team rates exploitation as theoretical and the affected configuration as uncommon, but the same release also fixes several access bypass and cross-site scripting issues that affect more sites.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-exclamation-triangle” icon_size=”20″ min_height=”120″]\n

Affected: <\/strong><\/h4>\n

Webform 6.2.x before 6.2.12 and 6.3.x before 6.3.1.[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-check” icon_size=”20″ min_height=”120″]\n

Fixed version: <\/strong><\/h4>\n

6.2.12 and 6.3.1.[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-star” icon_size=”20″ min_height=”120″]\n

CVSS: <\/strong><\/h4>\n

Rated Critical by the Drupal Security Team (Drupal risk scoring, not CVSS).[\/fancy_box][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”What This Means For You:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]Shared hosting: On shared hosting, a site that uses the affected form configuration could have its content, submissions and files exposed or changed by an anonymous visitor.<\/p>\n

VPS and dedicated servers: On a VPS or dedicated server the same applies, and code execution would run as the web server user, which may give access to other sites hosted on the same server.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Recommended Action:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]Update Webform to 6.2.12 or 6.3.1 on every Drupal site, even if you do not use custom multiple-value formats, as the release fixes 22 separate issues.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_padding=”2%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”`{`Critical`}` cPanel CalDAV and CardDAV Root Code Execution (CVE-2026-87899)” text_direction=”default”][\/split_line_heading][divider line_type=”Full Width Line” line_thickness=”3″ divider_color=”default”][vc_column_text css=”” text_direction=”default”]cPanel disclosed on 22 September 2026 that its CalDAV and CardDAV service, which stores each account’s calendars and contacts, fails to sanitise input passed to a privileged task. As a result, any logged-in cPanel account holder can run code as root and take full control of the server. cPanel lists no requirement other than having an account. The same release fixes a related flaw (CVE-2026-68490) that lets a local user read other accounts’ calendars and contacts, and a WP Toolkit issue (CVE-2026-87900) that lets one cPanel user change databases belonging to other accounts. All three were reported by researcher Ali Mustafa (rz1027), who has been credited with at least seven cPanel and Plesk flaws since late August.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-exclamation-triangle” icon_size=”20″ min_height=”120″]\n

Affected: <\/strong><\/h4>\n

cPanel & WHM version 120 and later.[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-check” icon_size=”20″ min_height=”120″]\n

Fixed version: <\/strong><\/h4>\n

11.134.0.57, 11.136.0.41, 11.138.0.8 or later, and WP Squared 11.138.1.11 or later. WP Toolkit 6.11.3 or later for CVE-2026-87900.[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-star” icon_size=”20″ min_height=”120″]\n

CVSS: <\/strong><\/h4>\n

Not published by cPanel at the time of writing; cPanel describes the impact as full control of the server.[\/fancy_box][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”What This Means For You:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]Shared hosting: On shared hosting, this is the most serious kind of flaw, because any one account on a server, or anyone who has stolen that account’s password, could take over the whole server and every website on it.<\/p>\n

VPS and dedicated servers: On a VPS or dedicated server where you are the only cPanel user, the risk is lower, but a compromised account password or a compromised site could still be turned into full root access.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Recommended Action:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]Make sure cPanel & WHM is on a fixed build (run \/usr\/local\/cpanel\/scripts\/upcp –force if automatic updates are off) and update WP Toolkit to 6.11.3 or later. There is no temporary workaround, so updating is the only fix.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_padding=”2%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”`{`Critical`}` WordPress “Login with QR“ Plugin Unauthenticated Admin Takeover (CVE-2026-86710)” text_direction=”default”][\/split_line_heading][divider line_type=”Full Width Line” line_thickness=”3″ divider_color=”default”][vc_column_text css=”” text_direction=”default”]A vulnerability disclosed on 17 September 2026 in the WordPress plugin “Login with QR” (versions up to and including 1.0.0) allows any unauthenticated visitor to log in as any user on the site, including administrators. The plugin is meant to let a user log in by scanning a QR code, but it fails to verify that the code presented is one it actually issued, instead accepting any code that matches a stored value, which an attacker can guess or generate themselves. No fixed version has been published yet.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_padding=”2%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”How to Check If Your Site Has Been Compromised” text_direction=”default”][\/split_line_heading][divider line_type=”Full Width Line” line_thickness=”3″ divider_color=”default”]

\n
    \n
  • Review the WordPress or Drupal administrator user list for accounts you do not recognise, particularly any created or given extra permissions in the last week.<\/li>\n
  • Look for new or recently changed .php files in your uploads folders and in plugin, theme and module folders.<\/li>\n
  • Check your website access logs for repeated or unusual form submissions to quote, booking or upload handlers.<\/li>\n
  • Check for unfamiliar cron jobs or scheduled tasks in your hosting account or on your server.<\/li>\n
  • Look for outbound connections to unfamiliar IP addresses or domains, or unexpected spikes in resource use.<\/li>\n
  • If you find anything suspicious, change all passwords and API keys, restore from a known clean backup where possible, and contact our support team.<\/li>\n<\/ul>\n <\/div>[\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_padding=”2%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Frequently Asked Questions” text_direction=”default”][\/split_line_heading][divider line_type=”Full Width Line” line_thickness=”3″ divider_color=”default”][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”I keep WordPress itself up to date. Does that protect me from the Addify plugin flaw?” text_direction=”default”][\/split_line_heading]
    <\/i> <\/div>
    No. Plugin flaws are separate from WordPress core, and premium plugins bought outside WordPress.org often need updating individually. It is worth checking your installed plugins list regularly, not just the WordPress version. <\/div>
    <\/div><\/div>[\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”How urgently should I act on these issues?” text_direction=”default”][\/split_line_heading]
    <\/i> <\/div>
    The Addify plugin flaw needs no account and has no fix yet, so it should be dealt with straight away if you use that plugin. The cPanel flaw is equally urgent for anyone managing their own cPanel server. The Drupal Webform issue should be addressed promptly, as the release fixes 22 separate problems. <\/div>
    <\/div><\/div>[\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”What if the plugin I rely on has no fix yet?” text_direction=”default”][\/split_line_heading]
    <\/i> <\/div>
    Where no fixed version exists, as with the Addify Request a Quote plugin, the safest option is to deactivate the plugin until the developer releases an update. If the feature is essential, speak to your developer about temporary protections such as blocking PHP execution in upload folders. <\/div>
    <\/div><\/div>[\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Does the cPanel flaw affect my website if I am on shared hosting?” text_direction=”default”][\/split_line_heading]
    <\/i> <\/div>
    The cPanel flaw affects the server rather than an individual website, so it is addressed by updating cPanel & WHM on the server itself. If you manage your own cPanel server, you should confirm it is on a fixed build. <\/div>
    <\/div><\/div>[\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”I use Drupal but not custom multiple-value formats in Webform. Do I still need to update?” text_direction=”default”][\/split_line_heading]
    <\/i> <\/div>
    Yes. The Webform release fixes 22 separate issues, several of which affect common configurations, so updating to 6.2.12 or 6.3.1 is recommended for every site that uses the module. <\/div>
    <\/div><\/div>[\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none”][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Summary” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]\n\n\n\n\n\n\n
    Vulnerability<\/strong><\/td>\nCVE<\/strong><\/td>\nCVSS<\/strong><\/td>\nAffected<\/strong><\/td>\nFixed<\/strong><\/td>\nAction<\/strong><\/td>\n<\/tr>\n
    Addify Request a Quote for WooCommerce file upload<\/td>\nCVE-2026-18143<\/td>\n9.8<\/td>\n<= 2.9.2<\/td>\nNone yet<\/td>\nDeactivate plugin<\/td>\n<\/tr>\n
    Drupal Webform remote code execution<\/td>\nCVE-2026-96355<\/td>\nCritical (Drupal)<\/td>\n6.2.x < 6.2.12, 6.3.x < 6.3.1<\/td>\n6.2.12 \/ 6.3.1<\/td>\nUpdate Webform<\/td>\n<\/tr>\n
    cPanel CalDAV\/CardDAV root code execution<\/td>\nCVE-2026-87899<\/td>\nNot published<\/td>\ncPanel & WHM 120+<\/td>\n11.134.0.57 \/ 11.136.0.41 \/ 11.138.0.8<\/td>\nUpdate cPanel & WHM<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n[\/vc_column_text][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” top_padding=”3%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Need Help? Get in Touch” text_direction=”default”][\/split_line_heading][divider line_type=”Full Width Line” line_thickness=”3″ divider_color=”default”][vc_column_text css=”” text_direction=”default”]If you have any questions about these issues or need help checking your account, please raise a support ticket via the Customer Area at heartinternet.uk, or use live chat, available Monday to Friday, 09:30 to 16:00. You can also find more guidance in our knowledge base at heartinternet.uk\/support. We are here to help if you are not sure whether any of this affects you.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row]\n","protected":false},"excerpt":{"rendered":"

    [vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_padding=”2%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″…<\/p>\n","protected":false},"author":81,"featured_media":27531,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-27717","post","type-post","status-publish","format-standard","has-post-thumbnail","category-uncategorised"],"_links":{"self":[{"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/posts\/27717","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/users\/81"}],"replies":[{"embeddable":true,"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/comments?post=27717"}],"version-history":[{"count":3,"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/posts\/27717\/revisions"}],"predecessor-version":[{"id":27723,"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/posts\/27717\/revisions\/27723"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/media\/27531"}],"wp:attachment":[{"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/media?parent=27717"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/categories?post=27717"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/tags?post=27717"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}