WP Toolkit for cPanel CVE-2026-87900: Argument Injection
WP Toolkit for cPanel is affected by CVE-2026-87900. Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts. Affected versions: 6.11.2-10794 and earlier. Fixed in 6.11.3-10850. CVSS base score: 9.4.
Затронутые версии
6.11.2-10794 and earlier
Исправленная версия
6.11.3-10850
Команда обновления по умолчанию
bash <(curl -SsL https://wp-toolkit.plesk.com/cPanel/installer.sh) --version 6.11.3Команды исправления
All supported operating systems
# WP Toolkit (package wp-toolkit-cpanel) updates independently of cPanel & WHM
bash <(curl -SsL https://wp-toolkit.plesk.com/cPanel/installer.sh || wget -qO- https://wp-toolkit.plesk.com/cPanel/installer.sh) --version 6.11.3Что это значит по лицензии SharedLicense
Your SharedLicense cPanel license itself is not affected — this is a vulnerability in WP Toolkit for cPanel, not in licensing. Licenses continue to work during and after the update; there is no need to re-issue or re-activate anything. If you resell under your own brand, patch client servers too — unpatched installs put your reputation at risk, not your license.
Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts.
Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-87900
Часто задаваемые вопросы
What is CVE-2026-87900?
Is CVE-2026-87900 being exploited in the wild?
How do I fix CVE-2026-87900?
Which versions are affected?
Проверьте систему на уязвимости
Выберите продукт и операционную систему, чтобы увидеть точные команды исправления.
Проверьте свою систему