CVE-2026-87900

CriticalCVSS 9.4/10Last modified Sep 24, 2026

Description

Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts.

Metrics

CVSS 4.0 9.4/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-88

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
WebPros	WP Toolkit for cPanel	<= 6.11.2-10794

References

https://support.cpanel.net/hc/en-us/articles/43597969409943

Timeline

Published: Sep 23, 2026
Last modified: Sep 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-879018.3Improper sanitization in the registration module allows reflected Cross-Site Scripting.CVE-2026-879028.1An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the CVE-2026-879075.3The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking ser CVE-2026-879087.5multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the pa CVE-2026-879097.5The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function. This CVE-2026-87916.4The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookingWebsiteUrl` setting in all versi CVE-2026-879105.7When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, th CVE-2026-879119.6An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1 CVE-2026-879125.9A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before 1.1.0 might allow remo CVE-2026-879135.9A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain CVE-2026-879157.2The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Sto CVE-2026-879165.3The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions,