Recent vulnerabilities discovered in cPanel’s services have exposed significant security risks, allowing users with hosting accounts to gain root access and control over the entire server. These issues were acknowledged by cPanel on September 22, 2026, highlighting the urgency for users to update their systems.
Details of the cPanel Exploits
A primary flaw identified in the CalDAV and CardDAV services enables a hosting account holder to execute code with root privileges, potentially compromising server integrity. This issue does not require additional permissions beyond holding an account on a shared server, making it accessible to many users.
Additionally, a vulnerability within the WP Toolkit plugin compromises database integrity by allowing unauthorized access to alter databases associated with other accounts. This flaw primarily affects versions up to WP Toolkit 6.11.2-10794.
Patches and Fixes Released
cPanel has addressed these vulnerabilities by releasing updated versions of their services. The critical CalDAV and CardDAV issue is resolved in cPanel & WHM versions 11.134.0.57, 11.136.0.41, and 11.138.0.8, among others. For the WP Toolkit bug, users are advised to upgrade to version 6.11.3 or later to ensure their systems are secure.
While no temporary workarounds have been provided for those unable to update immediately, cPanel recommends users follow their detailed update instructions to mitigate these risks effectively.
Implications and Security Recommendations
The discovery of these vulnerabilities underscores the critical need for regular system updates and vigilance in server management. cPanel has credited researcher Ali Mustafa, known as rz1027, for uncovering these flaws, further emphasizing the importance of collaboration between security researchers and software providers.
Operators using both cPanel and Plesk, another control panel from the same parent company, should remain alert for updates, as similar vulnerabilities may exist across platforms.
As the landscape of web security continues to evolve, staying informed and proactive about potential threats is essential for maintaining robust server defenses.
For those managing affected systems, immediate updates are crucial. Follow cPanel’s guidance for upgrading cPanel & WHM and WP Toolkit to the latest versions to protect against unauthorized access and potential data breaches.
