Current state, checked July 6, 2026: CVE-2025-67888 is still worth a hosting-admin clarification because public references have associated the issue with Softaculous or SitePad, while Softaculous says its review did not identify vulnerable code in those products. FixItPhill did not have a dedicated public post for this clarification in the live REST search.
The safe operating conclusion is that this should be handled as a Control Web Panel (CWP) maintenance and exposure issue, not as a reason to remove Softaculous or SitePad from a hosting server. NVD lists Control Web Panel before 0.9.8.1209 in the CVE record, and Softaculous points administrators back to CWP-side remediation.
What changed
Softaculous published a clarification explaining that Softaculous and SitePad integrate with CWP through CWP-provided API functionality. Their review says the relevant code path is maintained by the CWP project, can be present in environments beyond Softaculous or SitePad integrations, and does not require removing Softaculous or SitePad as a mitigation step.
That matters because false attribution can produce the wrong maintenance action. Removing a website installer or builder from a panel may disrupt customers while leaving the CWP-side issue unresolved. The fix path should start with CWP updates and panel hardening.
Hosting admin checklist
- Identify any CWP servers, including older internal, reseller, staging, and customer-managed systems.
- Confirm whether the CWP version is before 0.9.8.1209 and plan updates according to CWP guidance.
- Restrict administrative panel access to trusted networks where possible.
- Review whether CWP API functionality is enabled and whether it is still required for current integrations.
- Keep Softaculous and SitePad updated, but do not treat removing them as the primary fix for CVE-2025-67888.
- Review panel logs for unusual administrative activity without publishing sensitive traffic details or private account data.
- Rotate integration credentials if you find evidence that the panel was exposed or misused.
- Document the final CWP version, exposure changes, and verification date for each affected server.
Customer communication
If customers ask whether Softaculous or SitePad is the vulnerable component, the most accurate answer is narrower: public CVE references mentioned those products, but Softaculous says its review points to CWP-maintained functionality. Customers need to know whether their CWP installation was updated and whether administrative access was tightened.
Safety note
This article intentionally omits the public request details, parameter names, and direct reproduction material from outside reports. The useful guidance for defenders is the affected platform, version threshold, vendor clarification, and maintenance checklist.
