CVE-2026-84069: WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated LFI via assets/index.php
The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it to include a local file, allowing unauthenticated users to perform Local File Inclusion.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WebFacing WordPress pluginto a version that resolves this vulnerability.Fixed in 5.4
Event History
Frequently Asked Questions
Which installations are affected?
WebFacing WordPress plugin versions before 5.4 are affected. The provided version range specifically identifies 5.3 through 5.3.6.
Does exploitation require authentication?
No. The issue is described as unauthenticated, so an attacker does not need a WordPress or cPanel account to attempt exploitation.
What must an attacker be able to do?
An attacker must be able to access the exposed bundled script and supply a path value that causes it to include a local file. The vulnerability exists because that path is not validated.
What is the immediate remediation?
Update the WebFacing WordPress plugin to version 5.4 or later. The vulnerability affects versions before 5.4.