cPanel Flaw Lets One Hosting Account Gain Root Access on Shared Servers

cPanel has patched a vulnerability that allows an authenticated hosting account to execute code as root and take full control of the server.

Tracked as CVE-2026-87899, the flaw affects cPanel & WHM version 120 and later. On shared hosting, the impact can extend far beyond the account used to launch the attack: root access breaks the isolation between hosting customers.

cPanel also disclosed two related issues on September 22. One affects WP Toolkit and can allow a cPanel user to modify databases belonging to other hosting accounts. Another can expose calendars and contacts stored by other users on the same server.

If you manage a cPanel server, check the installed versions and update now. If your WordPress site is on shared or managed cPanel hosting, ask your provider to confirm that the server has been patched.

Affected and patched versions

cPanel published the affected and fixed versions in its CVE-2026-87899 security advisory and the separate advisory for the WP Toolkit issue.

Why CVE-2026-87899 matters on shared hosting

The flaw sits in cPanel’s CalDAV/CardDAV handling. The bigger problem is what it gives an attacker: root access.

Shared hosting depends on keeping customer accounts isolated. A user logged into one cPanel account should not be able to reach another customer’s files, databases or services. Root access removes that boundary.

The vulnerability requires an authenticated cPanel account, but on a shared server that is not a particularly high barrier. Every hosting customer already has one, and stolen cPanel credentials would satisfy the same requirement.

According to cPanel, successful exploitation results in code execution as root, giving the attacker full control of the server. Its advisory does not list an additional prerequisite beyond having an authenticated cPanel account.

cPanel’s advisory does not report known exploitation of CVE-2026-87899 at the time of publication. That does not reduce the urgency of patching an account-to-root vulnerability on a multi-user server.

WP Toolkit can modify databases in other accounts

CVE-2026-87900 is particularly relevant to WordPress hosting.

WP Toolkit is commonly used inside cPanel to install and manage WordPress sites. According to cPanel’s WP Toolkit advisory, an authenticated cPanel user can exploit the flaw to perform database modifications in other hosting accounts.

WP Toolkit 6.11.2-10794 and earlier is affected. The issue is fixed in 6.11.3 or later.

There are still important details cPanel has not disclosed. The advisory does not explain exactly which database changes are possible, whether another account’s database contents can also be read, or whether the flaw can be used directly to gain WordPress administrator access.

Those capabilities should not be assumed. What is confirmed is already serious: one hosting account can modify a database belonging to another account.

The third vulnerability, CVE-2026-68490, affects the same CalDAV/CardDAV functionality. It can allow a local user to read calendar events and contacts belonging to other accounts, but cPanel says it does not provide root access or allow that data to be modified.

What cPanel server administrators should do

Start by checking the installed cPanel version:

/usr/local/cpanel/cpanel -V

For CVE-2026-87899 and CVE-2026-68490, the server should be running at least the patched build for its release line:

11.134.0.57
11.136.0.41
11.138.0.8
WP Squared 11.138.1.11

Later builds are also patched.

cPanel can be updated from WHM → Home → cPanel → Upgrade to Latest Version, or from the command line:

/usr/local/cpanel/scripts/upcp --force

cPanel documents the command and available update options in its upcp documentation.

Do not assume automatic updates have already handled the issue. Check the installed build after updating.

Check WP Toolkit separately

Updating cPanel does not confirm that WP Toolkit has also been updated.

Servers using WP Toolkit should be running 6.11.3 or later. cPanel provides the following update command:

bash <(curl https://wp-toolkit.plesk.com/cPanel/installer.sh || wget -O - https://wp-toolkit.plesk.com/cPanel/installer.sh) --version 6.11.3

Check both versions rather than treating the main cPanel update as confirmation that WP Toolkit is also patched.

What WordPress site owners should do

Most WordPress users on shared hosting cannot patch cPanel themselves.

If your hosting provider uses cPanel, ask them to confirm that the server hosting your account has been updated for CVE-2026-87899.

If WP Toolkit is installed, also ask whether it is running version 6.11.3 or later.

A hosting provider should be able to answer both questions directly.

There is no reason to assume that every WordPress site hosted on cPanel has been compromised. Patched versions are already available, and cPanel’s current advisories do not report known exploitation of the September 22 vulnerabilities.

If your provider confirms that the server remained vulnerable and there are signs of suspicious activity, the investigation should not stop at WordPress. A root-level server compromise can affect files, databases and configuration outside an individual hosting account.

Three cPanel account-to-root flaws in four weeks

CVE-2026-87899 is the third cPanel vulnerability disclosed since August 27 that cPanel says can take an authenticated hosting account to root.

August 27 – CVE-2026-65643: A flaw in cPanel’s domain parking functionality allowed an authenticated account with permission to add parked or addon domains to create arbitrary files and ultimately execute code as root. cPanel said successful exploitation could give an attacker control of the server and every account, website and database on it. Read the cPanel advisory.

September 8 – CVE-2026-67401: An EmailTrack vulnerability allowed an authenticated cPanel account with mail-related privileges to create arbitrary files and ultimately execute code as root. Read the cPanel advisory.

September 22 – CVE-2026-87899: The newly disclosed CalDAV/CardDAV flaw provides another path from an authenticated cPanel account to root.

With three account-to-root disclosures in less than four weeks, checking the actual installed build matters more than assuming automatic updates have kept a server current.

Patching does not prove the server was clean

Installing the update closes the vulnerability. It does not prove that the server was never exploited while it was vulnerable.

cPanel has not published indicators of compromise for these specific September 22 vulnerabilities. If a server shows unexplained root activity, unknown SSH keys, unexpected accounts or scheduled tasks, unauthorized WHM activity, or compromises across otherwise unrelated hosting accounts, investigate the server itself rather than limiting the review to WordPress.

A WordPress firewall or security plugin cannot patch a vulnerability in cPanel. If an attacker reaches root, they are operating below WordPress and may be able to modify site files, databases or server configuration directly.

Site-level protection still matters, but it cannot compensate for a compromised host.

For most users, the next step is straightforward: verify the cPanel build and, where WP Toolkit is installed, confirm that it is running version 6.11.3 or later.