CVE-2026-87900

Published: Set 23, 2026 Last Modified: Set 24, 2026
ExploitDB:
Other exploit source:
Google Dorks:
CRITICAL 9,4
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

AI Translation Available

Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts.

88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Availability Other
Potential Impacts:
Execute Unauthorized Code Or Commands Alter Execution Logic Read Application Data Modify Application Data
Applicable Platforms
Languages: Not Language-Specific, PHP
View CWE Details
https://support.cpanel.net/hc/en-us/articles/43597969409943
https://support.cpanel.net/hc/en-us/articles/43597969409943