A flaw in cPanel’s CalDAV and CardDAV service lets anyone with a cPanel hosting account run code as root and take “full control of the server,” the company said on September 22.
A second bug in the WP Toolkit plugin, used to install and manage WordPress sites, allows an account holder to change databases that belong to other accounts.
cPanel has released fixed versions for both, along with a fix for a third flaw in the same service, which stores each account’s calendars and contacts. That third flaw lets a local user on the server read other accounts’ calendar events and contacts, but not change them or gain root access.
cPanel lists no requirements for the root flaw other than having an account. On a shared server where a hosting provider sells accounts to the public, that means any customer could use it. So could anyone who gets hold of a customer’s login.
The three flaws and the versions that fix them:
| Flaw | Where | What it allows, according to cPanel | Affected | Fixed in |
|---|---|---|---|---|
| CVE-2026-87899 | CalDAV and CardDAV | A logged-in account holder can run code as root | cPanel & WHM version 120 and later |
11.134.0.57 or later 11.136.0.41 or later 11.138.0.8 or later WP Squared 11.138.1.11 or later |
| CVE-2026-87900 | WP Toolkit | A logged-in cPanel user can change databases in other accounts | WP Toolkit 6.11.2-10794 and older | WP Toolkit 6.11.3 or later |
| CVE-2026-68490 | CalDAV and CardDAV | A local user can read other accounts’ calendar events and contacts | cPanel & WHM version 120 and later |
11.134.0.57 or later 11.136.0.41 or later 11.138.0.8 or later WP Squared 11.138.1.11 or later |
The WP Toolkit bug is in how the plugin handles commands that create databases. cPanel says only that a logged-in cPanel user could “perform database modifications in other accounts.”
It does not say what changes are possible, whether data from other accounts can also be read, or whether the user needs access to WP Toolkit itself.
WP Toolkit is also available for Plesk, another hosting control panel from the same company, WebPros. cPanel has not said whether the Plesk version is affected.
None of the three advisories mentions exploitation or gives a way to check whether a server was attacked before it was updated. The flaws were not in CISA’s Known Exploited Vulnerabilities catalog when The Hacker News checked on September 23.
cPanel credits all three flaws to Ali Mustafa, a researcher who goes by rz1027. Vendor advisories and CVE records credit him with at least seven cPanel and Plesk flaws disclosed since August 27, three of them shared with a researcher known as abed1526.
They include a September 8 flaw in cPanel’s EmailTrack feature that let an account with mail privileges run code as root, cPanel said at the time.
Plesk fixed two more on September 10, in how its Backup Manager restores files and how it handles backup headers. It said each could let a customer take over the whole server.
How to Update
cPanel gives separate update instructions for cPanel & WHM and for WP Toolkit. WP Toolkit is installed as its own package, wp-toolkit-cpanel, with its own update.
- cPanel & WHM (CVE-2026-87899 and CVE-2026-68490): follow cPanel’s update steps. In WHM, go to Home / cPanel / Upgrade to Latest Version, or run /usr/local/cpanel/scripts/upcp –force as root. The update also repairs calendar and contact permissions for existing accounts.
- WP Toolkit (CVE-2026-87900): update to version 6.11.3 or later with this command: bash <(curl https://wp-toolkit.plesk.com/cPanel/installer.sh || wget -O – https://wp-toolkit.plesk.com/cPanel/installer.sh) –version 6.11.3
The calendar flaws affect version 120 and later, but cPanel lists fixed builds only for the 134, 136, and 138 release lines and for WP Squared.
cPanel offers no temporary workaround for servers that cannot be updated yet. For WP Toolkit, only the manual command is given, and whether automatic updates will install 6.11.3 is not stated.
