Loading vulnerability…
Argument injection in WP Toolkit for cPanel
CVE-2026-87900 is an argument-injection vulnerability in database-creation command handling in WP Toolkit for cPanel version 6.11.2-10794 and earlier. An authenticated remote cPanel user can exploit the flaw to modify databases belonging to other customer accounts, violating tenant isolation. The vulnerability also permits arbitrary file reads and arbitrary code execution across customer accounts. WP Toolkit version 6.11.3 and later fixes the issue.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise confidentiality through arbitrary file reads and integrity through unauthorized modifications to other accounts' databases, and can enable arbitrary code execution across customer accounts. The full range of database modifications and whether database contents can be read through the database-creation flaw are unspecified. Root-level execution is not specifically established for this vulnerability.
If you can’t patch tonight, do this now.
Until the upgrade is completed, restrict access to cPanel/WHM to trusted administrators and networks, and monitor for unauthorized database changes or suspicious privileged activity. These measures reduce exposure but do not replace installing the fixed WP Toolkit release.
Patch, then assume compromise.
Upgrade the separately packaged WP Toolkit for cPanel component to version 6.11.3 or later. Updating cPanel & WHM alone should not be treated as remediation for this WP Toolkit vulnerability. Verify the installed WP Toolkit version after upgrading and investigate unexplained cross-account database activity.
No public exploits tracked yet. Mallory keeps watching.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.