WebPros security advisory (AV26-961)
Canada's Cyber Centre urges patches for root code-execution flaws in Plesk, cPanel, and WebPros extensions.
The Canadian Centre for Cyber Security issued advisory AV26-961 on WebPros vulnerabilities affecting Plesk, its extensions, WP Toolkit, and cPanel/WHM. CVE-2026-68492 and CVE-2026-87898 allow arbitrary code execution as root through the Plesk RESTful API and Site Import extensions. CVE-2026-87899 concerns cPanel CalDAV/CardDAV, and CVE-2026-87900 concerns WP Toolkit database creation. Administrators are urged to apply updates; the advisory does not report exploitation.
- CVE-2026-68492 allows root code execution via the Plesk RESTful API extension.
- CVE-2026-87898 allows root code execution in Plesk's Site Import extension.
- CVE-2026-87899 and CVE-2026-87900 affect cPanel CalDAV/CardDAV and WP Toolkit.
- Affected Plesk 18.0 and several cPanel/WHM builds should be updated; exploitation is not reported.
- Vendors
- WebPros
- Organizations
- Canadian Centre for Cyber Security
- Countries
- Canada
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-68492 | Authenticated Root Code Execution via Untrusted Search Path in Plesk RESTful API | 8.7 | — | ||
| CVE-2026-87898 | Authenticated OS Command Injection in Plesk Yields Root Code Execution | 9.4 | — | ||
| CVE-2026-87899 | Authenticated Privilege Escalation to Root RCE in cPanel & WHM | 9.4 | — | ||
| CVE-2026-87900 | Argument Injection in WP Toolkit for cPanel Allows Cross-Account File Read and RCE | 9.4 | — |
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-961 Date: September 24, 2026 As of September 23, 2026, WebPros is affected by vulnerabilities in the following products: Plesk Versions 18. 0. 34 to 18.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.