CVE-2026-29202

Received Received - Intake

Insufficient Input Validation Leads to Arbitrary Perl Code Execution

Publication date: 2026-05-08

Last updated on: 2026-05-11

Assigner: HackerOne

Description

Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution on behalf of the already authenticated account's system user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-08

Last Modified

2026-05-11

Generated

2026-07-09

AI Q&A

2026-05-08

EPSS Evaluated

2026-07-08

NVD

CVE-2026-29202

EUVD

EUVD-2026-28811

Affected Vendors & Products

Vendor	Product	Version / Range
cpanel	whm	From 11.136.0.9 (inc)
wp_squared	wp_squared	From 11.136.1.10 (inc)
cpanel	whm	v110.0.114

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability involves insufficient input validation of the `plugin` parameter in the `create_user` plugin. Because of this flaw, an attacker who is already authenticated can execute arbitrary Perl code on the system with the privileges of the authenticated user's system account.

Impact Analysis

The vulnerability allows an authenticated user to run arbitrary Perl code on the system, which can lead to unauthorized actions such as data manipulation, privilege escalation, or system compromise depending on the permissions of the affected user account.

Compliance Impact

The vulnerability allows arbitrary Perl code execution on behalf of an authenticated system user, which can lead to unauthorized access and potential data breaches.

Such unauthorized access and potential compromise of system integrity can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data.

Organizations using affected versions should apply the security updates promptly to mitigate risks and maintain compliance.

Detection Guidance

Detection of this vulnerability involves verifying the version of cPanel & WHM or WP Squared installed on your system to ensure it is not an affected version.

You can check the current cPanel version using the command:

/usr/local/cpanel/cpanel -V

If the version is older than 11.136.0.9 for cPanel & WHM or 11.136.1.10 for WP Squared, your system may be vulnerable.

Mitigation Strategies

To mitigate this vulnerability, immediately update your cPanel & WHM or WP Squared installation to a patched version.

For cPanel & WHM, run the following command to force an update:

/scripts/upcp --force

After the update, verify the installed version with:

/usr/local/cpanel/cpanel -V

Ensure the version is at least 11.136.0.9 for cPanel & WHM or 11.136.1.10 for WP Squared. For older systems like CentOS 6 or CloudLinux 6, update directly to version v110.0.114.

Following these steps will protect your system from arbitrary Perl code execution via the create_user plugin vulnerability.

Hi! I’m here to help you understand CVE-2026-29202. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70