cPanel/WHM CalDAV/CardDAV and WP Toolkit Flaws Enable Cross-Account Access and Root Privilege Escalation (CVE-2026-68490, CVE-2026-87899, CVE-2026-87900)

cPanel/WHM CalDAV/CardDAV and WP Toolkit Flaws Enable (TL-2026-2636) is a critical-severity software vulnerability scored CVSS 9.4, first published 2026-09-23. It has no confirmed attribution, affects cPanel (WebPros) cPanel & WHM (CalDAV/CardDAV - cpdavd), references 3 CVEs (CVE-2026-68490, CVE-2026-87899, CVE-2026-87900), maps to 11 MITRE ATT&CK techniques (T1005, T1059, T1078), and is covered by 9 detection rules and 5 indicators of compromise.

Key facts for TL-2026-2636

Threat ID
TL-2026-2636
Severity
CRITICAL
CVSS
9.4 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
Status
MONITORING
Category
VULNERABILITY
First published
2026-09-23
Last reviewed
2026-09-23
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
web hosting, technology
Target regions
Global
Detection rules
9
Indicators of compromise
5

On September 22, 2026 cPanel fixed three tenant-isolation flaws affecting shared-hosting servers running cPanel & WHM 120 and later: a CalDAV/CardDAV privilege escalation that lets any authenticated cPanel account holder execute code as root (CVE-2026-87899, CVSS 4.0 9.4), an incorrect-permission flaw exposing other accounts' calendars and contacts to local users (CVE-2026-68490, CVSS 4.0 8.2), and an argument injection in WP Toolkit for cPanel <= 6.11.2-10794 that lets logged-in users modify other accounts' databases and, per the CVE record, read arbitrary files and execute code across customer accounts (CVE-2026-87900, CVSS 4.0 9.4). No in-the-wild exploitation or public PoC has been reported; fixes are in cPanel & WHM 11.134.0.57, 11.136.0.41, 11.138.0.8, WP Squared 11.138.1.11 and WP Toolkit 6.11.3.

How cPanel/WHM CalDAV/CardDAV and WP Toolkit Flaws Enable works

On September 22, 2026, cPanel (WebPros) published a security release addressing three vulnerabilities that break tenant isolation on multi-tenant shared-hosting servers. Two of the flaws are in cPanel's CalDAV/CardDAV functionality, which is served by the cpdavd daemon (ports 2079/TCP plain and 2080/TCP SSL). cpdavd runs with root privileges and stores per-account calendar and address-book data under the account home directory ($homedir/.caldav/<principal>/<collection>/). The third flaw is in WebPros' WP Toolkit plugin for cPanel. All three CVE records were published to NVD on September 23, 2026 with CVSS 4.0 scores.

CVE-2026-87899 (CWE-250, Execution with Unnecessary Privileges; CVSS 4.0 9.4, AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) is the most severe. According to the NVD description, it "allows remote authenticated users to execute arbitrary code with root privileges." Secondary reporting (SecurityOnline) attributes the flaw to privileged CalDAV/CardDAV background tasks that fail to sanitize user-controlled input. The only precondition is a valid cPanel account - no additional privilege or mail package is required - so on a shared server any single compromised or malicious customer account can be escalated to root, yielding control of the host and every other account on it. Per post-disclosure analysis (Blogspan), root on a shared cPanel host means access to every customer account, the ability to modify or delete hosted websites, access to all customer mailboxes and credentials, and the ability to install persistent backdoors. The CVE record lists affected builds 11.120.0.0-11.134.0.56, 11.136.0.0-11.136.0.40 and 11.138.0.0-11.138.0.7; no temporary mitigation was provided. HackerOne is the CNA for all three CVEs.

CVE-2026-68490 (CWE-732, Incorrect Permission Assignment for Critical Resource; CVSS 4.0 8.2, AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N) stems from incorrect permissions on CalDAV/CardDAV storage, allowing a local user on the same server to read calendar events and contacts belonging to other cPanel accounts. Exposure is read-only (no modification, no privilege escalation), but the leaked names, email addresses, business relationships and meeting schedules are directly useful for targeted phishing and social engineering. The fix corrects permissions for newly created calendar/address-book storage and repairs unsafe permissions on existing accounts. The issue was reported by researcher Ali Mustafa (rz1027), who is credited with at least seven cPanel and Plesk flaws disclosed since August 27, 2026.

CVE-2026-87900 (CWE-88, Argument Injection; CVSS 4.0 9.4) affects database-creation command handling in WP Toolkit for cPanel versions 6.11.2-10794 and earlier. The vendor advisory describes a logged-in cPanel user being able to modify databases owned by other accounts; the CVE/NVD record goes further, stating the argument injection "allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts." The CVE record lists 6.11.3-10850 as the first unaffected build and also credits Ali Mustafa (rz1027); The Hacker News reports he is credited with all three flaws. WP Toolkit ships and updates separately from cPanel, so upcp alone does not fix it - it must be upgraded to 6.11.3 or later with the WP Toolkit installer.

Context: this release lands during a heavy run of cPanel ecosystem vulnerabilities in 2026. CVE-2026-41940 (authentication bypass, CVSS 9.8) was exploited from late February 2026 until its April 28 patch and used to deploy the Go-based "Sorry" Linux ransomware against at least 44,000 cPanel IPs; cpdavd itself previously carried CVE-2026-29205, a pre-auth arbitrary root file read in its CalDAV attachment handler (fixed May 13, 2026). September 2026 also saw an EmailTrack SQL injection (CVE-2026-67401), a ConfigServer Security & Firewall flaw (CVE-2026-65638), a domain-parking flaw (CVE-2026-65643) and several Plesk issues. As of September 23, 2026, none of the three CVEs is in CISA KEV, and no in-the-wild exploitation, public PoC or IOCs have been reported. Given how quickly attackers weaponized earlier cPanel flaws, administrators should patch immediately and review account, database, calendar and address-book activity for unexplained cross-account access.

MITRE ATT&CK techniques used in TL-2026-2636

Collection

T1005 Data from Local System; T1114.001 Local Email Collection

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1566 Phishing

Privilege Escalation

T1078.003 Local Accounts

Credential Access

T1552.001 Credentials In Files

Impact

T1565.001 Stored Data Manipulation

Reconnaissance

T1589.002 Email Addresses; T1591.002 Business Relationships

Affected products and versions in cPanel/WHM CalDAV/CardDAV and WP Toolkit Flaws Enable

  • cPanel (WebPros) — cPanel & WHM (CalDAV/CardDAV - cpdavd)
    Vulnerable versions: 120 and later prior to fixed builds
    Fixed in: 11.134.0.57; 11.136.0.41; 11.138.0.8
  • cPanel (WebPros) — WP Squared
    Vulnerable versions: builds prior to 11.138.1.11
    Fixed in: 11.138.1.11
  • WebPros — WP Toolkit for cPanel
    Vulnerable versions: <= 6.11.2-10794
    Fixed in: 6.11.3-10850

Remediation for cPanel/WHM CalDAV/CardDAV and WP Toolkit Flaws Enable

Patches

  • cPanel & WHM 11.134.0.57
  • cPanel & WHM 11.136.0.41
  • cPanel & WHM 11.138.0.8
  • WP Squared 11.138.1.11
  • WP Toolkit for cPanel 6.11.3

Immediate actions

  • Upgrade cPanel & WHM to 11.134.0.57, 11.136.0.41, 11.138.0.8 or later (WP Squared 11.138.1.11 or later) via WHM Home / cPanel / Upgrade to Latest Version, or run /usr/local/cpanel/scripts/upcp --force as root
  • Upgrade WP Toolkit for cPanel separately to 6.11.3 or later: bash <(curl https://wp-toolkit.plesk.com/cPanel/installer.sh || wget -O - https://wp-toolkit.plesk.com/cPanel/installer.sh) --version 6.11.3
  • Confirm installed versions after upgrading (/usr/local/cpanel/cpanel -V for cPanel & WHM; WP Toolkit package version must be 6.11.3 or later)
  • Prioritize public multi-tenant shared-hosting servers, where any single customer account is a viable root-escalation foothold

Workarounds

  • No temporary mitigation was published for CVE-2026-68490 or CVE-2026-87899; patching is the only vendor-supported fix
  • Where calendar/contacts are not required, restricting access to cpdavd ports 2079/2080 reduces exposure but is not a vendor-documented mitigation

Longer-term hardening

  • Review account, database, calendar and address-book activity for unexplained cross-account access or database changes
  • Audit permissions on per-account CalDAV/CardDAV storage ($homedir/.caldav) for cross-account readability
  • Keep cPanel automatic updates enabled and track cPanel/WebPros security advisories given the high 2026 cadence of cPanel ecosystem flaws
  • Monitor for unexpected root-owned child processes spawned by cpdavd and for anomalous WP Toolkit database-creation operations

CVEs associated with cPanel/WHM CalDAV/CardDAV and WP Toolkit Flaws Enable

CVE-2026-68490, CVE-2026-87899, CVE-2026-87900

Weaknesses (CWE) in cPanel/WHM CalDAV/CardDAV and WP Toolkit Flaws Enable

CWE-732, CWE-250, CWE-88

Timeline of cPanel/WHM CalDAV/CardDAV and WP Toolkit Flaws Enable

  • cPanel patched CVE-2026-41940 (auth bypass, CVSS 9.8), exploited since late February 2026 to deploy 'Sorry' Linux ransomware on at least 44,000 cPanel IPs - context for how fast cPanel flaws get weaponized
  • cPanel shipped a fix for CVE-2026-29205, a pre-auth arbitrary root file read in the same cpdavd CalDAV daemon (publicly detailed by Searchlight Cyber on May 18, 2026)
  • First of at least seven cPanel and Plesk flaws credited to researcher Ali Mustafa (rz1027) is disclosed, starting a series that includes CVE-2026-68490
  • Related cPanel EmailTrack SQL injection flaw (CVE-2026-67401) disclosed
  • Several related Plesk flaws disclosed
  • cPanel published advisories and fixed builds for CVE-2026-68490 and CVE-2026-87899 (cPanel & WHM 11.134.0.57, 11.136.0.41, 11.138.0.8; WP Squared 11.138.1.11) and CVE-2026-87900 (WP Toolkit 6.11.3)
  • Cyber Security News, The Hacker News and others reported the flaws; none were in CISA KEV and no in-the-wild exploitation or public PoC was reported
  • CVE records published to NVD with CVSS 4.0 scores: CVE-2026-87899 9.4 (CWE-250), CVE-2026-87900 9.4 (CWE-88), CVE-2026-68490 8.2 (CWE-732)

Sources cited for cPanel/WHM CalDAV/CardDAV and WP Toolkit Flaws Enable

More in vulnerability

Detection coverage for TL-2026-2636

As of 2026-09-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2636 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats