CVE-2026-87900

Awaiting Analysis Awaiting Analysis - Queue

Argument Injection in WP Toolkit for cPanel

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: HackerOne

Description

Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-10-14

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-12

NVD

CVE-2026-87900

EUVD

EUVD-2026-85619

Affected Vendors & Products

Vendor	Product	Version / Range
wp_toolkit	wp_toolkit	to 6.11.2 (exc)
cpanel	wp_toolkit	to 6.11.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

Executive Summary

This vulnerability is an argument injection flaw in WP Toolkit for cPanel versions 6.11.2-10794 and earlier. It allows remote authenticated users to inject malicious arguments into commands, enabling them to read arbitrary files and execute arbitrary code across different customer accounts on the same server.

Detection Guidance

To detect this vulnerability, check the installed version of WP Toolkit using the command: rpm -q wp-toolkit. If the version is 6.11.2-10794 or earlier, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability could allow an attacker with authenticated access to compromise other user accounts on the same cPanel server. This may lead to unauthorized data access, code execution, or further lateral movement within the system.

Compliance Impact

This vulnerability allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts, which could lead to unauthorized access to sensitive data. Such access may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy) by exposing personal or protected health information.

Mitigation Strategies

Update WP Toolkit to version 6.11.3 or later using the command provided in the advisory from cPanel's support page.

Hi! I’m here to help you understand CVE-2026-87900. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70