WebPros security advisory (AV26-961)
Canada's Cyber Centre urges patches for root code-execution flaws in Plesk, cPanel, and WebPros extensions.
The Canadian Centre for Cyber Security issued advisory AV26-961 on WebPros vulnerabilities affecting Plesk, its extensions, WP Toolkit, and cPanel/WHM. CVE-2026-68492 and CVE-2026-87898 allow arbitrary code execution as root through the Plesk RESTful API and Site Import extensions. CVE-2026-87899 concerns cPanel CalDAV/CardDAV, and CVE-2026-87900 concerns WP Toolkit database creation. Administrators are urged to apply updates; the advisory does not report exploitation.
68