cPanel CalDAV flaw allows hosting account holders to execute code as root

Affected Systems

cPanel & WHM version 120 and later (CVE-2026-87899, CVE-2026-68490); WP Toolkit 6.11.2-10794 and older (CVE-2026-87900). Affects shared hosting environments where cPanel is deployed. WP Squared also affected.

Exploitation Status

No active exploitation reported as of September 23, 2026. Not listed in CISA KEV catalog. No detection methods provided by vendor. Researcher Ali Mustafa (rz1027) credited with discovery.

Business Impact

CVE-2026-87899 enables any authenticated cPanel account holder to escalate privileges to root and gain full server control on shared hosting infrastructure. CVE-2026-87900 allows cross-account database modification via WP Toolkit. CVE-2026-68490 permits local users to read calendar and contact data from other accounts. Shared hosting providers face immediate risk of full server compromise by any customer or compromised account.

Urgency

🔴 Immediate

Recommended Actions

• Update cPanel & WHM to version 11.134.0.57, 11.136.0.41, 11.138.0.8, or WP Squared 11.138.1.11 or later via WHM (Home / cPanel / Upgrade to Latest Version) or run /usr/local/cpanel/scripts/upcp --force as root
• Update WP Toolkit to version 6.11.3 or later using: bash <(curl https://wp-toolkit.plesk.com/cPanel/installer.sh || wget -O - https://wp-toolkit.plesk.com/cPanel/installer.sh) --version 6.11.3
• Review cPanel account activity logs for suspicious privilege escalation attempts or unauthorized database access since August 2026
• Audit all active cPanel accounts on shared hosting servers for unauthorized or suspicious accounts created recently
• Monitor for root-level process execution originating from cPanel user contexts and cross-account database queries in WP Toolkit logs