{"id":3099,"date":"2026-09-23T13:30:13","date_gmt":"2026-09-23T13:30:13","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3099"},"modified":"2026-09-23T13:30:13","modified_gmt":"2026-09-23T13:30:13","slug":"new-cpanel-flaw-lets-a-hosting-account-run-code-as-root-take-full-server-control","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3099","title":{"rendered":"New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control"},"content":{"rendered":"
\n

\ue804<\/i>Swati Khandelwal<\/span>\ue802<\/i>Sep 23, 2026<\/span><\/span>Vulnerability \/ Web Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

A flaw in cPanel’s CalDAV and CardDAV service<\/a> lets anyone with a cPanel hosting account run code as root and take \u00abfull control of the server,\u00bb the company said on September 22.<\/p>\n

A second bug<\/a> in the WP Toolkit plugin, used to install and manage WordPress sites, allows an account holder to change databases that belong to other accounts.<\/p>\n

cPanel has released fixed versions for both, along with a fix for a third flaw<\/a> in the same service, which stores each account’s calendars and contacts. That third flaw lets a local user on the server read other accounts’ calendar events and contacts, but not change them or gain root access.<\/p>\n

cPanel lists no requirements for the root flaw other than having an account. On a shared server where a hosting provider sells accounts to the public, that means any customer could use it. So could anyone who gets hold of a customer’s login.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The three flaws and the versions that fix them:<\/p>\n

<\/p>\n\n\n\n\n\n\n
\n Flaw\n <\/th>\n\n Where\n <\/th>\n\n What it allows, according to cPanel\n <\/th>\n\n Affected\n <\/th>\n\n Fixed in\n <\/th>\n<\/tr>\n
\n CVE-2026-87899\n <\/th>\n\n CalDAV and CardDAV\n <\/td>\n\n A logged-in account holder can run code as root\n <\/td>\n\n cPanel & WHM version 120 and later\n <\/td>\n\n 11.134.0.57 or later
\n
11.136.0.41 or later
\n
11.138.0.8 or later
\n
WP Squared 11.138.1.11 or later\n <\/td>\n<\/tr>\n
\n CVE-2026-87900\n <\/th>\n\n WP Toolkit\n <\/td>\n\n A logged-in cPanel user can change databases in other accounts\n <\/td>\n\n WP Toolkit 6.11.2-10794 and older\n <\/td>\n\n WP Toolkit 6.11.3 or later\n <\/td>\n<\/tr>\n
\n CVE-2026-68490\n <\/th>\n\n CalDAV and CardDAV\n <\/td>\n\n A local user can read other accounts’ calendar events and contacts\n <\/td>\n\n cPanel & WHM version 120 and later\n <\/td>\n\n 11.134.0.57 or later
\n
11.136.0.41 or later
\n
11.138.0.8 or later
\n
WP Squared 11.138.1.11 or later\n <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The WP Toolkit bug is in how the plugin handles commands that create databases. cPanel says only that a logged-in cPanel user could \u00abperform database modifications in other accounts.\u00bb<\/p>\n

It does not say what changes are possible, whether data from other accounts can also be read, or whether the user needs access to WP Toolkit itself.<\/p>\n

WP Toolkit is also available for Plesk, another hosting control panel from the same company, WebPros. cPanel has not said whether the Plesk version is affected.<\/p>\n

None of the three advisories mentions exploitation or gives a way to check whether a server was attacked before it was updated. The flaws were not in CISA’s Known Exploited Vulnerabilities catalog when The Hacker News checked on September 23.<\/p>\n

cPanel credits all three flaws to Ali Mustafa, a researcher who goes by rz1027. Vendor advisories and CVE records credit him with at least seven cPanel and Plesk flaws disclosed since August 27, three of them shared with a researcher known as abed1526.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

They include a September 8 flaw in cPanel’s EmailTrack feature that let an account with mail privileges run code as root, cPanel said at the time.<\/p>\n

Plesk fixed two more on September 10, in how its Backup Manager restores files<\/a> and how it handles backup headers<\/a>. It said each could let a customer take over the whole server.<\/p>\n

How to Update<\/h3>\n

cPanel gives separate update instructions for cPanel & WHM and for WP Toolkit. WP Toolkit is installed as its own package<\/a>, wp-toolkit-cpanel, with its own update.<\/p>\n