CVE-2026-87900

UNKNOWN

Description

Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts.

Timeline

Published:September 23rd, 2026 8:17 PM

Last modified:September 24th, 2026 9:16 PM

CVSS Scoring

No CVSS v3 score available

Weaknesses (CWE)

CWE-88

References & Reports

Advisories, patches, and third-party reports

https://support.cpanel.net/hc/en-us/articles/43597969409943

Source: NIST NVD · Data may lag official sources by up to one minute