WebPros security advisory (AV26-961)

Plesk Obsidian versions 18.0.34 through 18.0.80.7 and 18.0.81.0 contain an untrusted search path flaw (CWE-426) that is exploitable when the Plesk RESTful API extension (versions 2.4.2 through 2.4.6) is installed. A remote attacker with any valid Plesk account (low-privilege, authenticated access is sufficient) can trigger the flaw through the extension's API, causing Plesk to load and execute a malicious component from an attacker-influenced path. Successful exploitation yields arbitrary code execution as root, giving full compromise of the host and every website and customer account it serves. This affects Plesk-powered hosting servers, VPS instances, and dedicated servers where the RESTful API extension is enabled; exploitation status is currently none known (not in CISA KEV, no public PoC).

Do: Update Plesk to 18.0.80.8 or 18.0.81.1 (or later) and update the RESTful API extension to 2.4.7 or later. If the RESTful API extension is not required, remove or disable it as the simplest mitigation. Audit Plesk authentication and extension logs for unexpected API activity by low-privileged accounts, and restrict access to the Plesk panel and API to trusted networks or VPNs.

Plesk, a widely deployed hosting control panel, contains an OS command injection flaw (CWE-78) that lets a remote authenticated user run arbitrary operating-system commands with root privileges. An attacker with any valid Plesk account (including low-privileged reseller or customer logins, depending on the affected component) could submit crafted input that Plesk passes unsafely to a shell, escalating from panel access to full control of the underlying server. Because Plesk servers host customer websites, email, and databases, successful exploitation means complete compromise of every tenant and service on the box, with cross-system impact reflected in the CVSS 4.0 score of 9.4 (critical). The attack requires network access and an authenticated session, but no user interaction. There is currently no known public proof of concept and the flaw is not on the CISA KEV catalog, so exploitation status is none known.

Do: Apply the vendor's fix immediately via Plesk Updates as soon as the patched release is available, and check the Plesk security advisory for the exact fixed version. Because exploitation requires a valid login, audit Plesk user and reseller accounts for unknown or dormant credentials, enforce MFA, and restrict access to the control panel port (8443) to trusted IPs via firewall rules. Review server logs and the Plesk panel log for unexpected command execution or new cron jobs/SUID binaries, and inspect hosted sites for webshells if compromise is suspected.

CVE-2026-87899 is an execution-with-unnecessary-privileges flaw (CWE-250) in cPanel that lets any remote authenticated user — for example an ordinary hosting account on a shared server, or an attacker who has compromised one — execute arbitrary code with root privileges. The attack requires only low-privilege credentials and no user interaction, and a successful exploit yields complete control of the underlying server, including every other tenant's accounts, websites, databases, and email, which is consistent with reporting that the flaw enables cross-account access. This primarily threatens multi-tenant shared hosting environments where cPanel & WHM is the dominant control panel. The bug is rated critical (CVSS 4.0: 9.4) and a vendor fix has been released, but it is not on the CISA KEV list and no public proof-of-concept is known. No exploitation in the wild has been reported so far, though the pool of potentially affected servers is very large.

Do: Update all cPanel & WHM servers to the latest vendor release (via the CURRENT/RELEASE/LTS tier you track) as soon as the fix reaches your update tier, and confirm the update applied in WHM's update log. Because exploitation needs only a low-privileged hosting account, audit tenant accounts for weak or compromised credentials, enforce least privilege, and review for post-exploitation indicators such as unexpected root-owned processes, new SUID binaries, added cron jobs, modified SSH authorized_keys, and anomalous outbound traffic from the server.

CVE-2026-87900 is an argument injection flaw (CWE-88) in the WP Toolkit add-on for cPanel servers, affecting version 6.11.2-10794 and earlier. A remote attacker needs only a low-privileged, authenticated hosting account on an affected server and sends specially crafted arguments to WP Toolkit operations, with no user interaction required. Successful exploitation lets the attacker read arbitrary files and execute arbitrary code across other customer accounts on the same server, and press reports indicate the issue can escalate to running code as root and taking full control of the hosting server. The affected population is hosting providers running cPanel with WP Toolkit installed, along with all of their hosted customers. The flaw is rated critical (CVSS 4.0: 9.4), but it is not on the CISA KEV list, no public proof of concept exists, and no exploitation in the wild has been reported so far.

Do: Hosting providers should immediately update WP Toolkit for cPanel to any build newer than 6.11.2-10794 via WHM and verify the installed version. Because exploitation only requires an ordinary authenticated hosting account, review server logs for unusual WP Toolkit activity, cross-account file access, or unexpected processes/cron jobs, and rotate credentials if compromise is suspected. Customers on shared hosts that have not patched should treat files and credentials in their accounts as potentially exposed until the provider confirms remediation.