Back to Security Advisories

WP Toolkit for cPanel CVE-2026-87900: Argument Injection

WP Toolkit for cPanel is affected by CVE-2026-87900. Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts. Affected versions: 6.11.2-10794 and earlier. Fixed in 6.11.3-10850. CVSS base score: 9.4.

Critical 9.4 CVSS
cPanel AlmaLinux 8 AlmaLinux 9 CentOS 7 CloudLinux 7 CloudLinux 8 CloudLinux 9

Affected Versions

6.11.2-10794 and earlier

Patched Version

6.11.3-10850

Default Update CMD

bash <(curl -SsL https://wp-toolkit.plesk.com/cPanel/installer.sh) --version 6.11.3

Fix Commands

All supported operating systems

# WP Toolkit (package wp-toolkit-cpanel) updates independently of cPanel & WHM
bash <(curl -SsL https://wp-toolkit.plesk.com/cPanel/installer.sh || wget -qO- https://wp-toolkit.plesk.com/cPanel/installer.sh) --version 6.11.3

What this means under a SharedLicense license

Your SharedLicense cPanel license itself is not affected — this is a vulnerability in WP Toolkit for cPanel, not in licensing. Licenses continue to work during and after the update; there is no need to re-issue or re-activate anything. If you resell under your own brand, patch client servers too — unpatched installs put your reputation at risk, not your license.

Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-87900

Frequently Asked Questions

What is CVE-2026-87900?
Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts. Affected versions: 6.11.2-10794 and earlier. Fixed in 6.11.3-10850.
Is CVE-2026-87900 being exploited in the wild?
No confirmed public exploitation has been announced at the time of writing. With a CVSS base score of 9.4, apply the update on your next maintenance window and watch the vendor advisory for changes.
How do I fix CVE-2026-87900?
WP Toolkit (package wp-toolkit-cpanel) updates independently of cPanel & WHM. bash <(curl -SsL https://wp-toolkit.plesk.com/cPanel/installer.sh || wget -qO- https://wp-toolkit.plesk.com/cPanel/installer.sh) --version 6.11.3.
Which versions are affected?
Affected: 6.11.2-10794 and earlier. Update to 6.11.3-10850 or later.

References

Security Advisories

Related Advisories

EasyApache 4 25.86 — cPanel & WHM Update

2026-10-01

ConfigServer Security & Firewall (CSF) 16.32-1 — cPanel & WHM Update

2026-09-30

Sitejet Builder 4.13.1-1 — cPanel & WHM Update

2026-09-30

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System