cPanel Fixes Flaw Letting Any Hosting Account Run Code as Root

On September 22, cPanel released fixed versions for three security flaws in its hosting control panel software, including a bug in the CalDAV and CardDAV service that lets anyone with a cPanel hosting account run code as root and take full control of the server, according to the company's advisory. CalDAV and CardDAV are the standards cPanel uses to store and sync each account's calendars and contacts. cPanel lists no requirement for the root flaw other than having an account, so on a shared server where a hosting provider sells accounts to the public, any customer could use it, as could anyone who obtains a customer's login.

The three flaws are tracked with Common Vulnerabilities and Exposures (CVE) identifiers. CVE-2026-87899 affects the CalDAV and CardDAV service and allows a logged-in account holder to run code as root. It affects cPanel & WHM version 120 and later, and it is fixed in version 11.134.0.57 or later, 11.136.0.41 or later, or 11.138.0.8 or later, and for the WP Squared product line in 11.138.1.11 or later. CVE-2026-87900 affects the WP Toolkit plugin, which is used to install and manage WordPress sites. It allows a logged-in cPanel user to change databases that belong to other accounts. The affected versions are WP Toolkit 6.11.2-10794 and older, and the fix is WP Toolkit 6.11.3 or later. CVE-2026-68490 is a third flaw in the same CalDAV and CardDAV service. It lets a local user on the server read other accounts' calendar events and contacts, but not change them or gain root access. It is fixed in the same cPanel & WHM builds listed for the root flaw, as well as WP Squared 11.138.1.11 or later.

The WP Toolkit bug sits in how the plugin handles commands that create databases. cPanel states only that a logged-in cPanel user could perform database modifications in other accounts. The company has not said what changes are possible, whether data from other accounts can also be read, or whether the user needs access to WP Toolkit itself. WP Toolkit is also available for Plesk, another hosting control panel made by the same company, WebPros. cPanel has not said whether the Plesk version is affected.

cPanel credits all three flaws to Ali Mustafa, a researcher who goes by the handle rz1027. Vendor advisories and CVE records credit him with at least seven cPanel and Plesk flaws disclosed since August 27, three of them shared with a researcher known as abed1526. Those include a September 8 flaw in cPanel's EmailTrack feature that let an account with mail privileges run code as root, according to cPanel at the time. Plesk fixed two more flaws on September 10, in how its Backup Manager restores files and how it handles backup headers; the company said each could let a customer take over the whole server.

None of the three advisories mentions any exploitation in the wild, and none gives administrators a way to check whether a server was attacked before it was updated. The flaws were not in the US Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities catalog when The Hacker News checked on September 23. cPanel offers no temporary workaround for servers that cannot be updated yet. For WP Toolkit, only the manual update command is given, and whether automatic updates will install version 6.11.3 is not stated.

To fix the calendar flaws, cPanel & WHM administrators can follow the vendor's update steps. In WebHost Manager (WHM), go to Home / cPanel / Upgrade to Latest Version, or run /usr/local/cpanel/scripts/upcp --force as root. The update also repairs calendar and contact permissions for existing accounts. For the WP Toolkit bug, update to version 6.11.3 or later with this command: bash <(curl https://wp-toolkit.plesk.com/cPanel/installer.sh || wget -O - https://wp-toolkit.plesk.com/cPanel/installer.sh) --version 6.11.3. The calendar flaws affect version 120 and later, but cPanel lists fixed builds only for the 134, 136, and 138 release lines and for WP Squared.

For website owners who would rather not apply control panel and plugin patches by hand, managed hosting services such as AEU Hosting (which runs on AEU Panel) handle server and control panel maintenance for their customers. Keeping cPanel, WP Toolkit, and the underlying server up to date remains the most direct protection against this type of account-to-root attack.