WP Toolkit for cPanel CVE-2026-87900: Argument Injection
WP Toolkit for cPanel is affected by CVE-2026-87900. Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts. Affected versions: 6.11.2-10794 and earlier. Fixed in 6.11.3-10850. CVSS base score: 9.4.
Betroffene Versionen
6.11.2-10794 and earlier
Gepatchte Version
6.11.3-10850
Standard-Update-Befehl
bash <(curl -SsL https://wp-toolkit.plesk.com/cPanel/installer.sh) --version 6.11.3Fix-Befehle
All supported operating systems
# WP Toolkit (package wp-toolkit-cpanel) updates independently of cPanel & WHM
bash <(curl -SsL https://wp-toolkit.plesk.com/cPanel/installer.sh || wget -qO- https://wp-toolkit.plesk.com/cPanel/installer.sh) --version 6.11.3Was das unter einer SharedLicense-Lizenz bedeutet
Your SharedLicense cPanel license itself is not affected — this is a vulnerability in WP Toolkit for cPanel, not in licensing. Licenses continue to work during and after the update; there is no need to re-issue or re-activate anything. If you resell under your own brand, patch client servers too — unpatched installs put your reputation at risk, not your license.
Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts.
Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-87900
Häufig gestellte Fragen
What is CVE-2026-87900?
Is CVE-2026-87900 being exploited in the wild?
How do I fix CVE-2026-87900?
Which versions are affected?
Referenzen
System auf Schwachstellen prüfen
Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.
System prüfen