Critical severityNVD Advisory· Published Sep 23, 2026· Updated Sep 24, 2026
CVE-2026-87900
CVE-2026-87900
Description
Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts.
Affected products
1- Range: <=6.11.2-10794
Patches
Vulnerability mechanics
References
1News mentions
3- ⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More ThreatsThe Hacker News · Sep 28, 2026
- New Cpanel Vulnerability Allows Attackers to Access Other Users’ AccountsCyber Security News · Sep 23, 2026
- New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server ControlThe Hacker News · Sep 23, 2026