CVE-2026-87900
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
WP Toolkit for cPanel versions 6.11.2-10794 and earlier contains an argument injection vulnerability that allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts.
Risk Assessment
An authenticated user can access files of other customers and execute code in their context, leading to account isolation breach and potential compromise of multiple websites. This poses a serious threat in hosting environments.
Recommendation
Update WP Toolkit for cPanel to the latest version containing the fix. Check for any unauthorized access to customer files.
Other vulnerabilities in WP Toolkit for cPanel
Original NVD description (English source)
Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS