WP Toolkit

Mentions · 7d0
Mentions · 30d0
All mentions3
First seenSep 23, 2026
Last mentionedSep 24, 2026

Timeline

3 articles · newest first

WebPros security advisory (AV26-961)

Canada's Cyber Centre urges patches for root code-execution flaws in Plesk, cPanel, and WebPros extensions.

Canadian Centre for Cyber SecuritySep 24, 14:43 UTC · Sep 24, 2026AdvisoryCVE-2026-68492 CVE-2026-87898 CVE-2026-87899+17 · 1 read

New Cpanel Vulnerability Allows Attackers to Access Other Users’ Accounts

cPanel patched a root privilege escalation and cross-tenant flaws in calendars, contacts, and WordPress databases.

Cyber Security NewsSep 23, 15:18 UTC · Sep 23, 2026VulnerabilityCVE-2026-68490 CVE-2026-87899 CVE-2026-87900+34 · 2 reads

New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control

cPanel patched three flaws, including a root code-execution bug any hosting account can use to seize the server.

The Hacker NewsSep 23, 12:16 UTC · Sep 23, 2026VulnerabilityCVE-2026-87899 CVE-2026-87900 CVE-2026-684904 · 1 read

Related CVEs

by mentions

CVE-2026-878999.4
Authenticated Privilege Escalation to Root RCE in cPanel & WHM
published Sep 23, 2026cPanel, L.L.C. cPanel & WHM
CVE-2026-879009.4
Argument Injection in WP Toolkit for cPanel Allows Cross-Account File Read and RCE
published Sep 23, 2026Plesk / WebPros (WP Toolkit) WP Toolkit for cPanel
CVE-2026-684908.2
CalDAV/CardDAV Permission Flaw in cPanel Lets Local Users Read Other Accounts' Data
published Sep 23, 2026cPanel (cPanel, L.L.C. / WebPros) cPanel & WHM (CalDAV/CardDAV calendar and contacts service)
CVE-2026-67401<1%9.9
Authenticated SQL Injection in cPanel EmailTrack Leads to Root RCE
published Sep 9, 2026cPanel (WebPros) cPanelPoC ×5
CVE-2026-878989.4
Authenticated OS Command Injection in Plesk Yields Root Code Execution
published Sep 23, 2026Plesk (WebPros) Plesk hosting control panel
CVE-2026-656389.2
Unauthenticated shell command injection in ConfigServer Security & Firewall (CSF)
published Sep 10, 2026ConfigServer Security & Firewall (CSF)
CVE-2026-684928.7
Authenticated Root Code Execution via Untrusted Search Path in Plesk RESTful API
published Sep 23, 2026Plesk Obsidian
CVE-2026-65643<1%8.7
Authenticated eval injection in cPanel enables root code execution
published Sep 1, 2026cPanel

Appears with

cPanelproduct · 3
WHMproduct · 3
WebProsvendor · 2
Pleskproduct · 2
WP Squaredproduct · 2
cPanelorganization · 2
cPanelvendor · 2
Plesk RESTful APIproduct · 1
LiteSpeedvendor · 1
ConfigServervendor · 1
Canadian Centre for Cyber Securityorganization · 1
LiteSpeed Enterpriseproduct · 1
WebProsorganization · 1
ConfigServer Security & Firewallproduct · 1
Site Importproduct · 1

Entities are extracted by the model from each article. First seen Sep 23, 2026, last mentioned Sep 24, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.