Loading vulnerability…
Perl Code Injection in cPanel & WHM create_user API
CVE-2026-29202 is an improper input validation vulnerability in cPanel & WHM and WP Squared affecting the create_user API path. The flaw resides in insufficient validation of the plugin parameter supplied to the create_user functionality, allowing attacker-controlled input to be interpreted as Perl code. A successfully authenticated attacker can trigger arbitrary Perl code execution in the security context of the associated account’s system user. In shared hosting environments, this creates a practical post-authentication code-execution primitive that can be used for file operations, persistence, and follow-on privilege-escalation activity.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary Perl code execution as the already authenticated account’s system user. This can result in full compromise of that account’s data and processes, including unauthorized reading and modification of files accessible to that user, deployment of persistence mechanisms, abuse of the hosting account for further attacks, and potential chaining with local privilege-escalation weaknesses to achieve broader server compromise. In multi-tenant hosting environments, the flaw materially increases the risk of lateral movement and full host takeover when combined with additional vulnerabilities.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by tightly restricting access to authenticated cPanel and WHM interfaces and API endpoints, limiting which users can invoke account-management functionality, and increasing monitoring for suspicious create_user API activity. Review logs for anomalous authenticated requests targeting account-creation workflows and investigate signs of unauthorized code execution under hosting account contexts. No complete workaround is available; patching is the primary mitigation.
Patch, then assume compromise.
Upgrade cPanel & WHM and WP Squared to a fixed release. Reported patched versions include cPanel & WHM 11.136.0.9, 11.134.0.25, 11.132.0.31, 11.130.0.22, 11.126.0.58, 11.124.0.37, 11.118.0.66, 11.110.0.116 or 11.110.0.117, 11.102.0.41, 11.94.0.30, and 11.86.0.43, as well as WP Squared 11.136.1.10 and later. Apply the vendor security update across all affected branches and verify that the installed build is at or above the fixed version for the deployed tier.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.