Why webmail cannot reset your password
Password recovery via a secondary address is disabled in webmail. The attack it prevents, and how to reset a mailbox password instead.
The Reset Password option in cPanel webmail — the one that emails a recovery link to a secondary address — is disabled on WebGee servers. Applies to shared, reseller and cPanel hosting.
Reset a password instead
Use cPanel:
- Open Email Accounts.
- Select Manage beside the address.
- Set a new password and select Update Email Settings.
The full procedure is in Change a mailbox password or quota.
If you cannot reach cPanel either, contact support.
Why it is disabled
The feature was removed in response to the AnonymousFox family of attacks, which exploit outdated or vulnerable WordPress plugins to gain access to an account's file system.
Once an attacker can read files in a hosting account, they can read the mail stored in it. Webmail's password reset works by sending the new password to a mailbox — and if that mailbox is on the same server, the attacker reads the reset message and gains an authenticated login. A file-system foothold becomes a working credential.
Disabling the feature removes that step.
This was never a server-level compromise. WebGee runs CageFS, which isolates each account's file system, so an exploit of this kind cannot reach other accounts on the same server.
What this means for you
The underlying risk is the vulnerable plugin, not the reset feature. Disabling the reset closes one route in; keeping your applications patched closes the door itself.
- Keep WordPress core, themes and plugins up to date.
- Remove plugins and themes you do not use — inactive code is still code on disk.
- Use a distinct password for each mailbox.
Related
Change a mailbox password or quota
Set a new password for an email account in cPanel, or change how much storage it is allowed to use.
Set up an autoresponder
Create an automatic reply in cPanel for holidays or acknowledgements, with the interval and stop-time settings that stop it becoming a nuisance.