Full Report
A flaw in cPanel's CalDAV and CardDAV service lets anyone with a cPanel hosting account run code as root and take "full control of the server," the company said on September 22. A second bug in the WP Toolkit plugin, used to install and manage WordPress sites, allows an account holder to change databases that belong to other accounts. cPanel has released fixed versions for both,
Analysis Summary
# Vulnerability: Multiple Flaws in cPanel CalDAV/CardDAV and WP Toolkit
## CVE Details
- **CVE ID:** CVE-2026-87899, CVE-2026-87900, CVE-2026-68490
- **CVSS Score:** Not explicitly specified in the text (Severity: High/Critical for root execution, Medium/High for database modification and data disclosure)
- **CWE:** Weakness type not available in the text
## Affected Systems
- **Products:**
- cPanel & WHM
- WP Squared
- WP Toolkit plugin (for cPanel)
- **Versions:**
- **CVE-2026-87899 & CVE-2026-68490:** cPanel & WHM version 120 and later
- **CVE-2026-87900:** WP Toolkit version 6.11.2-10794 and older
- **Configurations:** Shared hosting environments or any configuration where untrusted users possess a valid hosting account or local server access.
## Vulnerability Description
- **CVE-2026-87899 (CalDAV and CardDAV):** A flaw in cPanel's CalDAV and CardDAV service (used for storing account calendars and contacts) allows a logged-in account holder to execute arbitrary code with root privileges.
- **CVE-2026-87900 (WP Toolkit):** A flaw in how the plugin handles commands that create databases allows a logged-in cPanel user to perform database modifications across other accounts.
- **CVE-2026-68490 (CalDAV and CardDAV):** An information disclosure flaw in the calendar/contact service that allows a local user to read calendar events and contacts belonging to other accounts.
## Exploitation
- **Status:** Not exploited in the wild (Not present in CISA's Known Exploited Vulnerabilities catalog as of September 23, 2026); No public PoC mentioned.
- **Complexity:** Low (Requires only a standard hosting account or local access).
- **Attack Vector:** Network (for CVE-2026-87899 and CVE-2026-87900 via standard logged-in accounts) / Local (for CVE-2026-68490).
## Impact
- **Confidentiality:** High (Allows reading other accounts' calendar events, contacts, and potentially full system data via root access).
- **Integrity:** High (Allows unauthorized database modifications across accounts and full code execution as root).
- **Availability:** High (Root access allows complete takeover and control of the underlying server).
## Remediation
### Patches
- **cPanel & WHM / WP Squared (CVE-2026-87899 and CVE-2026-68490):** Upgrade to versions:
- 11.134.0.57 or later
- 11.136.0.41 or later
- 11.138.0.8 or later
- WP Squared: 11.138.1.11 or later
*Execution:* Navigate to **Home / cPanel / Upgrade to Latest Version** within WHM, or run the following command as root:
`usr/local/cpanel/scripts/upcp --force`
- **WP Toolkit (CVE-2026-87900):** Upgrade to **WP Toolkit 6.11.3** or later.
*Execution:* Update the `wp-toolkit-cpanel` package using the vendor-provided update script (`bash <(curl hxxps://wp-toolkit.plesk.com/cPanel/installe...`).
### Workarounds
- No temporary workarounds were provided by the vendor; immediate patching is advised.
## Detection
- **Indicators of Compromise:** No specific logs or IOCs are currently detailed by the vendor.
- **Detection methods and tools:** There are currently no provided methods to check whether a server was compromised prior to updating. Administrators should monitor user privilege actions and anomalous root-level behavior.
## References
- **Vendor Advisories:**
- cPanel Support (CVE-2026-87899): `hxxps://support.cpanel.net/hc/en-us/articles/43591715125271-Security-CVE-2026-87899-Vulnerability-in-cPanel-s-CalDAV-CardDAV-September-22-2026`
- cPanel Support (CVE-2026-87900): `hxxps://support.cpanel.net/hc/en-us/articles/43597969409943-Security-CVE-2026-87900-Vulnerability-in-WP-Toolkit-Database-Creation-September-22-2026`
- cPanel Support (CVE-2026-68490): `hxxps://support.cpanel.net/hc/en-us/articles/43502940099991-Security-CVE-2026-68490-Vulnerability-in-cPanel-s-CalDAV-CardDAV-Functionality-September-22-2026`
- **Relevant Links:**
- `hxxps://thehackernews.com/2026/09/new-cpanel-flaw-lets-hosting-account_0272795595.html`