cPanel WHM CVE-2026-29202

Exploitation requires a valid authenticated cPanel session (CVSS PR:L confirmed). The attacker must have an existing cPanel account on the target server and be able to invoke the create_user plugin's plugin parameter endpoint over the network (typically TCP/2082 or 2083). No non-default configuration is required - any cPanel installation that grants authenticated users access to this plugin is vulnerable by default. Code execution is bounded to the authenticated user's OS-level system account, meaning direct privilege escalation to root is not provided by this vulnerability alone - lateral movement or a secondary escalation step would be required to achieve root access. SSVC Automatable: no confirms that large-scale unauthenticated scanning exploitation is not feasible, as obtaining a valid cPanel account is a prerequisite. The primary risk population is shared hosting environments where untrusted third parties hold cPanel accounts.

The vendor-supplied CVSS 4.0 score of 5.3 with VC:L/VI:L appears conservative for a vulnerability that allows arbitrary code execution; the SSVC framework simultaneously rates Technical Impact as total, creating a direct conflict that defenders must resolve against their own environment. The CVSS PR:L metric confirms exploitation requires an authenticated session, which meaningfully bounds the attacker population. EPSS at 0.10% in the 26th percentile and SSVC Exploitation: none both indicate no active or automated exploitation at time of analysis, and SSVC Automatable: no suggests chaining into mass exploitation is non-trivial. For shared hosting providers where many untrusted users each hold a cPanel account, this vulnerability is a genuine concern - any one of those users could escalate from their web UI session to OS-level code execution. For enterprise environments where cPanel access is tightly controlled and the account population is small and trusted, real-world risk is materially lower than a code execution vulnerability might initially suggest. The CVSS 4.0 score may reflect the scoped execution context (authenticated user's system account rather than root), but this should be confirmed against the vendor advisory.

An authenticated cPanel user - such as a shared hosting tenant - crafts a malicious value for the plugin parameter of the create_user plugin and submits an HTTPS request to the cPanel web interface. The server-side Perl runtime processes the unsanitized parameter as executable code, granting the attacker OS-level code execution under their system user account. No public exploit code has been identified at time of analysis, but the vulnerability's straightforward parameter-injection nature makes proof-of-concept development accessible to any attacker with working knowledge of Perl and the cPanel API.