# cPanel/WHM CalDAV/CardDAV and WP Toolkit Flaws Enable Cross-Account Access and Root Privilege Escalation (CVE-2026-68490, CVE-2026-87899, CVE-2026-87900)

> On September 22, 2026 cPanel fixed three tenant-isolation flaws affecting shared-hosting servers running cPanel & WHM 120 and later: a CalDAV/CardDAV privilege escalation that lets any authenticated cPanel account holder execute code as root (CVE-2026-87899, CVSS 4.0 9.4), an incorrect-permission flaw exposing other accounts' calendars and contacts to local users (CVE-2026-68490, CVSS 4.0 8.2), and an argument injection in WP Toolkit for cPanel <= 6.11.2-10794 that lets logged-in users modify other accounts' databases and, per the CVE record, read arbitrary files and execute code across customer accounts (CVE-2026-87900, CVSS 4.0 9.4). No in-the-wild exploitation or public PoC has been reported; fixes are in cPanel & WHM 11.134.0.57, 11.136.0.41, 11.138.0.8, WP Squared 11.138.1.11 and WP Toolkit 6.11.3.

- **Published:** 2026-09-23T00:00:00Z
- **Last reviewed:** 2026-09-23T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2636
- **ID:** TL-2026-2636
- **Severity:** CRITICAL (CVSS 9.4)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 5 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-68490, CVE-2026-87899, CVE-2026-87900, CVE-2026-29205

## Description

On September 22, 2026, cPanel (WebPros) published a security release addressing three vulnerabilities that break tenant isolation on multi-tenant shared-hosting servers. Two of the flaws are in cPanel's CalDAV/CardDAV functionality, which is served by the cpdavd daemon (ports 2079/TCP plain and 2080/TCP SSL). cpdavd runs with root privileges and stores per-account calendar and address-book data under the account home directory ($homedir/.caldav/<principal>/<collection>/). The third flaw is in WebPros' WP Toolkit plugin for cPanel. All three CVE records were published to NVD on September 23, 2026 with CVSS 4.0 scores.

CVE-2026-87899 (CWE-250, Execution with Unnecessary Privileges; CVSS 4.0 9.4, AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) is the most severe. According to the NVD description, it "allows remote authenticated users to execute arbitrary code with root privileges." Secondary reporting (SecurityOnline) attributes the flaw to privileged CalDAV/CardDAV background tasks that fail to sanitize user-controlled input. The only precondition is a valid cPanel account - no additional privilege or mail package is required - so on a shared server any single compromised or malicious customer account can be escalated to root, yielding control of the host and every other account on it. Per post-disclosure analysis (Blogspan), root on a shared cPanel host means access to every customer account, the ability to modify or delete hosted websites, access to all customer mailboxes and credentials, and the ability to install persistent backdoors. The CVE record lists affected builds 11.120.0.0-11.134.0.56, 11.136.0.0-11.136.0.40 and 11.138.0.0-11.138.0.7; no temporary mitigation was provided. HackerOne is the CNA for all three CVEs.

CVE-2026-68490 (CWE-732, Incorrect Permission Assignment for Critical Resource; CVSS 4.0 8.2, AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N) stems from incorrect permissions on CalDAV/CardDAV storage, allowing a local user on the same server to read calendar events and contacts belonging to other cPanel accounts. Exposure is read-only (no modification, no privilege escalation), but the leaked names, email addresses, business relationships and meeting schedules are directly useful for targeted phishing and social engineering. The fix corrects permissions for newly created calendar/address-book storage and repairs unsafe permissions on existing accounts. The issue was reported by researcher Ali Mustafa (rz1027), who is credited with at least seven cPanel and Plesk flaws disclosed since August 27, 2026.

CVE-2026-87900 (CWE-88, Argument Injection; CVSS 4.0 9.4) affects database-creation command handling in WP Toolkit for cPanel versions 6.11.2-10794 and earlier. The vendor advisory describes a logged-in cPanel user being able to modify databases owned by other accounts; the CVE/NVD record goes further, stating the argument injection "allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts." The CVE record lists 6.11.3-10850 as the first unaffected build and also credits Ali Mustafa (rz1027); The Hacker News reports he is credited with all three flaws. WP Toolkit ships and updates separately from cPanel, so upcp alone does not fix it - it must be upgraded to 6.11.3 or later with the WP Toolkit installer.

Context: this release lands during a heavy run of cPanel ecosystem vulnerabilities in 2026. CVE-2026-41940 (authentication bypass, CVSS 9.8) was exploited from late February 2026 until its April 28 patch and used to deploy the Go-based "Sorry" Linux ransomware against at least 44,000 cPanel IPs; cpdavd itself previously carried CVE-2026-29205, a pre-auth arbitrary root file read in its CalDAV attachment handler (fixed May 13, 2026). September 2026 also saw an EmailTrack SQL injection (CVE-2026-67401), a ConfigServer Security & Firewall flaw (CVE-2026-65638), a domain-parking flaw (CVE-2026-65643) and several Plesk issues. As of September 23, 2026, none of the three CVEs is in CISA KEV, and no in-the-wild exploitation, public PoC or IOCs have been reported. Given how quickly attackers weaponized earlier cPanel flaws, administrators should patch immediately and review account, database, calendar and address-book activity for unexplained cross-account access.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1078.003 Local Accounts
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1005 Data from Local System
- T1565.001 Stored Data Manipulation
- T1589.002 Email Addresses
- T1591.002 Business Relationships
- T1566 Phishing
- T1114.001 Local Email Collection
- T1552.001 Credentials In Files

## Sources

- [New Cpanel Vulnerability Allows Attackers to Access Other Users' Accounts](https://cybersecuritynews.com/cpanel-user-account-access-flaw/)
- [cPanel Security: CVE-2026-68490 Vulnerability in cPanel's CalDAV/CardDAV Functionality (September 22, 2026)](https://support.cpanel.net/hc/en-us/articles/43502940099991-Security-CVE-2026-68490-Vulnerability-in-cPanel-s-CalDAV-CardDAV-Functionality-September-22-2026)
- [cPanel Support advisory for CVE-2026-87899](https://support.cpanel.net/hc/en-us/articles/43591715125271)
- [cPanel Support advisory for CVE-2026-87900 (WP Toolkit)](https://support.cpanel.net/hc/en-us/articles/43597969409943)
- [CVE.org record - CVE-2026-87899 (CNA: HackerOne)](https://www.cve.org/CVERecord?id=CVE-2026-87899)
- [CVE.org record - CVE-2026-87900 (CNA: HackerOne)](https://www.cve.org/CVERecord?id=CVE-2026-87900)
- [NVD - CVE-2026-68490](https://nvd.nist.gov/vuln/detail/CVE-2026-68490)
- [NVD - CVE-2026-87899](https://nvd.nist.gov/vuln/detail/CVE-2026-87899)
- [NVD - CVE-2026-87900](https://nvd.nist.gov/vuln/detail/CVE-2026-87900)
- [New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control](https://thehackernews.com/2026/09/new-cpanel-flaw-lets-hosting-account_0272795595.html)
- [Critical cPanel Security Vulnerabilities Allow Root Escalation](https://securityonline.info/cpanel-security-vulnerabilities-patch/)
- [cPanel Flaws Let Hosting Users Gain Root and Access Other Tenants](https://mallory.ai/stories/01a0ce6b-6e0f-7e5b-ab84-ea06a7f61828)
- [CVE-2026-87900: CWE-88 Argument Injection in WebPros WP Toolkit for cPanel (OffSeq Threat Radar)](https://radar.offseq.com/threat/cve-2026-87900-cwe-88-improper-neutralization-of-argument-delimiters-in-a-command-argument-injection-ea2d4bf21c354503)
- [CVE-2026-87899 - Overview, Insights & Trends (Intruder cvemon)](https://cvemon.intruder.io/cves/CVE-2026-87899)
- [CVE-2026-87899: cPanel-Luecke macht Login zu Root-Zugriff](https://www.blogspan.net/cpanel-cve-2026-87899-caldav-carddav-root/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2636