Hosting Security Roundup: September 2026 — wp2shell, cPanel 9.9 SQLi, Plesk & WHMCS

TL;DR: September brought four critical threats hosting providers should treat as urgent: the actively exploited wp2shell WordPress RCE chain, a CVSS 9.9 SQL injection in cPanel’s EmailTrack that ends in root access, two CVSS 9.9 Plesk vulnerabilities (symlink privesc and backup-manager file write), and an unauthenticated WHMCS RCE fixed on September 3. Patch cPanel, Plesk, WHMCS and WordPress core this week; CloudLinux users should also apply the September kernel updates covering seven local root exploits.

September 2026 has been an unusually heavy month for hosting-stack security. Between the exploited wp2shell WordPress chain, two CVSS 9.9 flaws in Plesk, a root-level SQL injection in cPanel and an unauthenticated WHMCS RCE, administrators running any mainstream hosting stack have real patching to do. This roundup walks through every major advisory we published this month, what each means in plain language, and the exact fix path — with links to the full advisories.

This roundup is written for hosting providers, resellers and server administrators running cPanel, Plesk, WHMCS, LiteSpeed or CloudLinux — including servers licensed through SharedLicense. Every item links to our full advisory with references to the vendor’s own announcement.

The Four That Matter Most

wp2shell: The Exploited WordPress RCE Chain

The headline threat this month is wp2shell: chaining CVE-2026-63030 (a WordPress REST API permission bypass) with CVE-2026-60137 produces unauthenticated remote code execution — no plugins, no credentials required. Rapid7’s analysis and NHS cyber alerts confirm it is being exploited in the wild, and a public scanner for vulnerable targets already exists.

The fix is unglamorous but simple: update WordPress core on every site you host (wp core update or Dashboard → Updates). For hosts, Imunify360 adds virtual patching that blocks the exploit chain on servers where individual sites are still unpatched — worth noting for resellers managing hundreds of customer sites. Full details in our wp2shell advisory.

cPanel: EmailTrack SQL Injection Reaching Root (CVSS 9.9)

CVE-2026-67401 lets an authenticated cPanel account with mail-related privileges escalate through a SQL injection in the EmailTrack functionality to arbitrary file creation and remote code execution as root. On shared hosting servers with many accounts, that moves the threat from theoretical to practical — any customer account becomes a potential server-takeover vector.

The patch shipped in cPanel’s September 8 security release. On licensed servers the update path is unchanged by licensing: sudo /scripts/upcp --force brings the server current. Our full advisory has the references. Administrators should also review the related database privilege escalation (CVE-2026-58048) fixed in August — improper SQL-mode handling during database renames could let accounts run SQL as the database root.

Plesk: Two CVSS 9.9 Vulnerabilities in Backup Infrastructure

Plesk’s September 10 release fixed two critical issues in its backup stack: a TOCTOU race condition with insecure symlink following that yields local privilege escalation to root (CVE-2026-68488), and a path traversal in Backup Manager allowing an authenticated customer to write arbitrary files as root (CVE-2026-68487). Both are rated 9.9.

Update with plesk installer --select-release-current --update-installed. Details: CVE-2026-68488 advisory and CVE-2026-68487 advisory. If you license Plesk through us, the update needs no license change — see our Plesk license page.

WHMCS: Unauthenticated RCE, Fixed September 3

CVE-2026-67399 is the one every billing-server operator should have patched by now: an input-validation failure leading to an unauthenticated deserialization chain and full system takeover (CVSS 9.8). The same release fixed CVE-2026-67398, a missing-authorization flaw in the 2Checkout gateway module that leaks customer data.

Fixed versions are 9.0.8 and 8.13.7 — anything older stays exposed. Upgrade from the WHMCS admin area or replace the application files with the current package. Advisories: WHMCS 9.0.8 and WHMCS 8.13.7. Running WHMCS under a SharedLicense WHMCS license changes nothing about the update path.

cPanel Login Bypass and the August Backlog

If you missed August’s CVE-2026-41940 — the critical authentication bypass in the cPanel login flow (CVSS 9.8, reportedly used for ransomware) — verify your build now: it was fixed in the WP2 security update of April 28, and follow-up WP2 releases through September closed five related issues (CVE-2026-29201 through 29206, 32991–32993). One upcp run covers all of them. The August database privilege escalation advisory has the background.

CloudLinux: Seven Local Root Kernel Exploits Patched

CloudLinux shipped kernel updates through September covering a run of named local root and container-escape exploits we track individually: Zapscape (KVM guest escape, CVSS 8.8), GhostLock, Bad epoll, RtabRace, BadGarbage, OVSwrap and RefluXFS. On CloudLinux servers the kernel is the isolation boundary between tenants — apply the kernel update and reboot on your maintenance schedule. Each advisory lists the exact yum/dnf commands per release.

Also This Month

• CSF Security Release (September 3) — two releases; reinstall from the latest package. CVE-2026-65638, CVE-2026-65639.
• Exim .forward privilege escalation — update the exim package and restart the service.
• Phusion Passenger watchdog API privesc — update the passenger package family.
• LiteSpeed Cache plugin for WordPress — three advisories (CVSS 7.2, 6.4 and a ShortPixel companion flaw): update the plugin on all hosted sites.
• EasyApache4 v25.62 — bundled fixes for cPanel Apache stacks; arrive with normal EA4 updates.

Your September Patch Checklist

1. WordPress core on every hosted site — wp2shell is active. Verify with Imunify360 or a core-version scan.
2. cPanel/WHM: sudo /scripts/upcp --force — covers CVE-2026-67401, CVE-2026-58048 and the WP2 series.
3. Plesk: plesk installer --select-release-current --update-installed.
4. WHMCS: upgrade to 9.0.8 or 8.13.7 — no exceptions for billing systems.
5. CloudLinux kernels: update and reboot for the seven local-root fixes.
6. CSF and Exim: reinstall/update from current packages.
7. LiteSpeed Cache plugin: update on customer sites, or verify Imunify360 coverage.

Frequently Asked Questions

Do SharedLicense licenses include security updates?

Yes — updates come directly from the vendors’ own channels (cPanel’s upcp, Plesk Installer, WHMCS releases), so a licensed server receives the same security fixes as an officially licensed one. Licensing and patching are independent.

Which of this month’s vulnerabilities are being actively exploited?

The wp2shell WordPress chain is confirmed exploited in the wild, and CVE-2026-41940 has credible reports of ransomware deployment. The remaining September CVEs have no confirmed exploitation at publication time, but with CVSS 9.8–9.9 ratings the window matters less than the patch.

I run a reseller under a white-label license — whose job is patching?

Yours. A white-label or reseller license covers the software commercial terms, not server administration. Patch the products on your servers and your clients’ servers; our advisories give you the exact commands to hand to your team.

Where do you publish new advisories?

Every item above lives in our Security Advisories hub, updated as vendors release fixes — including the per-OS fix commands for Ubuntu, AlmaLinux and CloudLinux errata.

Conclusion

September’s hosting security roundup comes down to four urgent patches — WordPress core (wp2shell), cPanel (EmailTrack SQLi), Plesk (backup-stack pair) and WHMCS (unauthenticated RCE) — plus CloudLinux kernel updates for a cluster of local root exploits. All are fixed by vendor updates; none require license changes. Run the checklist, verify versions, and you are current.

Browse the full feed in our Security Advisories hub, and if you need licenses for any of the affected products — cPanel from $4.50/mo, Plesk from $3.00/mo, WHMCS at $4/mo or Imunify360 at $2/mo — every license includes vendor updates and a 7-day money-back guarantee.

Sources: Rapid7, cPanel Security Center, WHMCS Help Center, NIST NVD.