A critical security flaw within **cPanel**'s **CalDAV** and **CardDAV** service (**CVE-2026-87899**) allows any user with a **cPanel** hosting account to execute code as root, effectively gaining "full control of the server." This vulnerability, disclosed by **cPanel** on September 22, presents a severe risk, especially in shared hosting environments where multiple customers share a single server. Simultaneously, a second significant bug (**CVE-2026-87900**) was identified in the **WP Toolkit** plugin, widely used for installing and managing **WordPress** sites. This flaw enables a logged-in account holder to modify databases belonging to other accounts on the same server. **cPanel** has also released a fix for a third vulnerability (**CVE-2026-68490**) in the **CalDAV** and **CardDAV** service. This particular flaw allows a local user on the server to read other accounts' calendar events and contacts, though it does not grant root access or the ability to alter data. ### Impact on Shared Hosting The root-level flaw in **CalDAV** and **CardDAV** requires only a valid **cPanel** account. This means that on shared hosting platforms, any customer could exploit this vulnerability. Furthermore, an attacker who compromises a single customer's login credentials could leverage this flaw to compromise the entire server. ### Vulnerability Details and Fixes The following table summarizes the identified flaws and the versions addressing them: | Flaw | Where | What it allows, according to **cPanel** | Affected | Fixed in | | :--- | :--- | :--- | :--- | :--- | | **CVE-2026-87899** | **CalDAV** and **CardDAV** | A logged-in account holder can run code as root | **cPanel & WHM** version 120 and later | 11.134.0.57 or later <br> 11.136.0.41 or later <br> 11.138.0.8 or later <br> **WP Squared** 11.138.1.11 or later | | **CVE-2026-87900** | **WP Toolkit** | A logged-in **cPanel** user can change databases in other accounts | **WP Toolkit** 6.11.2-10794 and older | **WP Toolkit** 6.11.3 or later | | **CVE-2026-68490** | **CalDAV** and **CardDAV** | A local user can read other accounts' calendar events and contacts | **cPanel & WHM** version 120 and later | 11.134.0.57 or later <br> 11.136.0.41 or later <br> 11.138.0.8 or later <br> **WP Squared** 11.138.1.11 or later | The **WP Toolkit** bug stems from how the plugin processes database creation commands. While **cPanel** confirms that logged-in users can perform database modifications in other accounts, it has not specified the full extent of possible changes, whether data can be read, or if access to **WP Toolkit** itself is a prerequisite. It is also unclear if **Plesk**, another hosting control panel from the same company, **WebPros**, is affected by the **WP Toolkit** vulnerability. ### No Evidence of Exploitation (Yet) As of September 23, none of the advisories indicate active exploitation, nor do they provide methods for detecting past attacks. The flaws were not listed in **CISA**'s Known Exploited Vulnerabilities catalog. All three vulnerabilities were credited to security researcher **Ali Mustafa**, known as rz1027. **Mustafa** has been credited with at least seven **cPanel** and **Plesk** flaws since August 27, some in collaboration with researcher abed1526. These include a September 8 flaw in **cPanel**'s **EmailTrack** feature that allowed mail-privileged accounts to gain root access. **Plesk** also addressed two critical vulnerabilities on September 10 related to its **Backup Manager**, both of which could lead to full server compromise by customers. ### How to Update Administrators are urged to update their systems immediately. **cPanel** provides separate update procedures for **cPanel & WHM** and **WP Toolkit**. * **cPanel & WHM** (**CVE-2026-87899** and **CVE-2026-68490**): Follow **cPanel**'s update steps. In **WHM**, navigate to Home / cPanel / Upgrade to Latest Version, or execute `/usr/local/cpanel/scripts/upcp --force` as root. This update will also correct calendar and contact permissions for existing accounts. * **WP Toolkit** (**CVE-2026-87900**): Update to version 6.11.3 or later using the following command: `bash <(curl https://wp-toolkit.plesk.com/cPanel/installer.sh || wget -O - https://wp-toolkit.plesk.com/cPanel/installer.sh) --version 6.11.3` While the calendar flaws affect version 120 and later, **cPanel** only lists fixed builds for the 134, 136, and 138 release lines, and for **WP Squared**. **cPanel** has not provided any temporary workarounds for servers that cannot be updated immediately. For **WP Toolkit**, only the manual command is provided, with no confirmation on whether automatic updates will deploy version 6.11.3.