cPanel fixes CalDAV flaw allowing account holders to run code as root

September 23, 2026 at 05:16 PM3 min

This digest was compiled by AI from multiple sources — links to the originals are below.

cPanel released fixes on September 22 for a CalDAV and CardDAV flaw that let any hosting account holder run code as root and take full server control. The company also patched a WP Toolkit bug allowing database changes in other accounts and a third flaw exposing calendar and contact data. No exploitation has been reported.

Key Facts

CVE-2026-87899 in cPanel's CalDAV and CardDAV service lets any logged-in account holder run code as root on cPanel & WHM version 120 and later.
cPanel fixed the root flaw in versions 11.134.0.57, 11.136.0.41, 11.138.0.8, and WP Squared 11.138.1.11 or later.
CVE-2026-87900 in WP Toolkit 6.11.2-10794 and older allows a logged-in cPanel user to modify databases in other accounts; fixed in WP Toolkit 6.11.3 or later.
CVE-2026-68490 lets a local user read other accounts' calendar events and contacts on the same CalDAV and CardDAV service.
cPanel credited all three flaws to researcher Ali Mustafa (rz1027), who has been credited with at least seven cPanel and Plesk flaws disclosed since August 27.

Root Access Flaw

The critical flaw CVE-2026-87899 resides in cPanel's CalDAV and CardDAV service, which stores each account's calendars and contacts. According to cPanel, a logged-in account holder can run code as root and take full control of the server. The flaw affects cPanel & WHM version 120 and later, and cPanel lists no requirements beyond having a hosting account. On a shared server where a hosting provider sells accounts to the public, any customer could exploit the flaw, as could anyone who obtains a customer's login. cPanel fixed the flaw in versions 11.134.0.57, 11.136.0.41, 11.138.0.8, and WP Squared 11.138.1.11 or later.

WP Toolkit Database Flaw

CVE-2026-87900 affects WP Toolkit, a plugin used to install and manage WordPress sites. The flaw allows a logged-in cPanel user to perform database modifications in other accounts. cPanel has not specified what changes are possible, whether data from other accounts can be read, or whether the user needs access to WP Toolkit itself. The vulnerability affects WP Toolkit 6.11.2-10794 and older, and is fixed in WP Toolkit 6.11.3 or later. WP Toolkit is also available for Plesk, another hosting control panel from the same company, WebPros, but cPanel has not said whether the Plesk version is affected.

Researcher Credits and Related Flaws

cPanel credited all three flaws to Ali Mustafa, a researcher who goes by rz1027. Vendor advisories and CVE records credit Mustafa with at least seven cPanel and Plesk flaws disclosed since August 27, three of them shared with a researcher known as abed1526. Among them is a September 8 flaw in cPanel's EmailTrack feature that let an account with mail privileges run code as root. Plesk fixed two more flaws on September 10, in how its Backup Manager restores files and how it handles backup headers, each of which could let a customer take over the whole server. None of the three advisories mentions exploitation or gives a way to check whether a server was attacked before it was updated, and the flaws were not in CISA's Known Exploited Vulnerabilities catalog when The Hacker News checked on September 23.