WP Toolkit (Product): news timeline & CVEs

WebPros security advisory (AV26-961)

Canada's Cyber Centre urges patches for root code-execution flaws in Plesk, cPanel, and WebPros extensions.

The Canadian Centre for Cyber Security issued advisory AV26-961 on WebPros vulnerabilities affecting Plesk, its extensions, WP Toolkit, and cPanel/WHM. CVE-2026-68492 and CVE-2026-87898 allow arbitrary code execution as root through the Plesk RESTful API and Site Import extensions. CVE-2026-87899 concerns cPanel CalDAV/CardDAV, and CVE-2026-87900 concerns WP Toolkit database creation. Administrators are urged to apply updates; the advisory does not report exploitation.

Canadian Centre for Cyber SecuritySep 24, 14:43 UTC · 2d agoAdvisory 6 sources CVE-2026-68492 CVE-2026-87898 CVE-2026-87899+1 CVEs

New Cpanel Vulnerability Allows Attackers to Access Other Users’ Accounts

cPanel patched a root privilege escalation and cross-tenant flaws in calendars, contacts, and WordPress databases.

cPanel's September 22, 2026 release fixes three tenant-isolation flaws in cPanel and WHM 120 and later. CVE-2026-68490 is an incorrect-permissions bug in CalDAV and CardDAV that lets a local user read, but not modify, other accounts' calendars and contacts. CVE-2026-87899 lets any authenticated cPanel user execute code as root, and CVE-2026-87900 in WP Toolkit through 6.11.2-10794 lets a user alter other accounts' databases. Fixed builds are 11.134.0.57, 11.136.0.41, 11.138.0.8, WP Squared 11.138.1.11 or newer, and WP Toolkit 6.11.3 or later; no exploitation is reported.

Cyber Security Newsupdated Sep 24, 14:43 UTC · 2d agofirst Sep 23, 15:18 UTC · 3d agoVulnerability 6 sources CVE-2026-68490 CVE-2026-87899 CVE-2026-87900+3 CVEs

New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control

cPanel patched three flaws, including a root code-execution bug any hosting account can use to seize the server.

cPanel disclosed three flaws on September 22, 2026, and released fixes. CVE-2026-87899 in CalDAV and CardDAV lets a logged-in hosting account run code as root on cPanel & WHM version 120 and later. CVE-2026-87900 in WP Toolkit 6.11.2 and older lets an account change other accounts' databases, while CVE-2026-68490 lets a local user read other accounts' calendars and contacts. cPanel reports no exploitation, the issues were not in CISA's KEV catalog, and no temporary workaround is offered.

The Hacker Newsupdated Sep 24, 14:43 UTC · 2d agofirst Sep 23, 12:16 UTC · 3d agoVulnerability 6 sources CVE-2026-87899 CVE-2026-87900 CVE-2026-68490

WP Toolkit

Timeline3 articles

Related CVEsby mentions

Appears with

WebPros security advisory (AV26-961)

New Cpanel Vulnerability Allows Attackers to Access Other Users’ Accounts

New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control