Back to Security Advisories

cPanel CVE-2026-93699

CVE-2026-93699 is an argument injection vulnerability in WP Toolkit for cPanel (CWE-88) that lets a local user execute arbitrary code as other accounts on the same server. NVD rates it 8.5, at the top of the High band. Because exploitation is local but crosses account boundaries, on shared hosting servers every hosted account is a potential path — update WP Toolkit through the panel's standard update channel (cPanel: sudo /scripts/upcp --force) as a priority.

Critical 8.5 CVSS
cPanel

What this means under a SharedLicense license

A local attacker with one account can run code as any other account on the server, breaking the account isolation that shared hosting depends on — privilege and data boundaries between customers collapse.

Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-93699

Frequently Asked Questions

What is CVE-2026-93699?
It is an argument injection vulnerability in WP Toolkit for cPanel, tracked as CWE-88 (improper neutralization of arguments). A local user can inject arguments into WP Toolkit operations and execute arbitrary code as other accounts on the same server. NVD rates it CVSS 8.5.
Who can exploit CVE-2026-93699?
It requires local access — any hosting customer or user with an account on the server qualifies. There is no indication of a remote path in the NVD description. The danger is crossing account boundaries: code runs as OTHER users, not just the attacker's own account.
How do I fix CVE-2026-93699?
Update WP Toolkit to the patched release through the panel's standard update channel — on cPanel run sudo /scripts/upcp --force (WP Toolkit ships with cPanel updates), then confirm the running WP Toolkit version in the interface. Also review hosted accounts for unexpected processes while the update rolls out.
Is CVE-2026-93699 being exploited in the wild?
The NVD record does not list known exploited status, and no CISA KEV listing is recorded for it. With an 8.5 score and account-boundary impact on shared servers, treat the update as urgent rather than waiting for exploitation reports.

References

Security Advisories

Related Advisories

EasyApache 4 25.91 — cPanel & WHM Update

2026-10-21

EasyApache 4 25.92 — cPanel & WHM Update

2026-10-21

cPanel CVE-2026-110672

2026-10-19 00:00:00

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System