Güvenlik Danışarlıklarına Dön

cPanel CVE-2026-93699

CVE-2026-93699 is an argument injection vulnerability in WP Toolkit for cPanel (CWE-88) that lets a local user execute arbitrary code as other accounts on the same server. NVD rates it 8.5, at the top of the High band. Because exploitation is local but crosses account boundaries, on shared hosting servers every hosted account is a potential path — update WP Toolkit through the panel's standard update channel (cPanel: sudo /scripts/upcp --force) as a priority.

Critical 8.5 CVSS
cPanel

SharedLicense lisansı altında bunun anlamı

A local attacker with one account can run code as any other account on the server, breaking the account isolation that shared hosting depends on — privilege and data boundaries between customers collapse.

Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-93699

Sıkça Sorulan Sorular

What is CVE-2026-93699?
It is an argument injection vulnerability in WP Toolkit for cPanel, tracked as CWE-88 (improper neutralization of arguments). A local user can inject arguments into WP Toolkit operations and execute arbitrary code as other accounts on the same server. NVD rates it CVSS 8.5.
Who can exploit CVE-2026-93699?
It requires local access — any hosting customer or user with an account on the server qualifies. There is no indication of a remote path in the NVD description. The danger is crossing account boundaries: code runs as OTHER users, not just the attacker's own account.
How do I fix CVE-2026-93699?
Update WP Toolkit to the patched release through the panel's standard update channel — on cPanel run sudo /scripts/upcp --force (WP Toolkit ships with cPanel updates), then confirm the running WP Toolkit version in the interface. Also review hosted accounts for unexpected processes while the update rolls out.
Is CVE-2026-93699 being exploited in the wild?
The NVD record does not list known exploited status, and no CISA KEV listing is recorded for it. With an 8.5 score and account-boundary impact on shared servers, treat the update as urgent rather than waiting for exploitation reports.

Referanslar

Güvenlik Danışarlıkları

İlgili Danışarlıklar

ConfigServer Security & Firewall (CSF) 16.35-1 — cPanel & WHM Update

2026-11-09

ConfigServer Security & Firewall (CSF) 16.34-1 — cPanel & WHM Update

2026-11-02

PHP Security Release – CVE-2026-115560

2026-10-24

Sisteminizi güvenlik açıkları açısından kontrol edin

Size uygun tam düzeltme komutlarını görmek için ürününüzü ve işletim sisteminizi seçin.

Sisteminizi Kontrol Edin