EUVD-2026-28811
GHSA-4jrh-q927-mvfj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Arbitrary Perl code execution as authenticated system user yields full read/write access to that account; availability impact is not directly confirmed by description, so rated Low rather than High.
Primary rating from NVD.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
10DescriptionCVE.org
Insufficient input validation of the plugin parameter of the create_user plugin allows arbitrary Perl code execution on behalf of the already authenticated account's system user.
AnalysisAI
Arbitrary Perl code execution in cPanel and WP Squared via insufficient validation of the plugin parameter in the create_user plugin, allowing any authenticated user to execute arbitrary Perl code as their underlying system user account. Vendor-supplied CVSS 4.0 rates this Medium (5.3) with PR:L confirming authentication is required, while SSVC simultaneously rates Technical Impact as total - a notable discrepancy defenders should note. No public exploit has been identified and CISA has not added it to KEV; WebPros released patches across all affected branches on May 8, 2026.
Technical ContextAI
cPanel is a widely-deployed web hosting control panel platform developed by WebPros and written largely in Perl. The create_user plugin exposes a plugin parameter that is forwarded to internal Perl execution routines without sufficient sanitization, satisfying CWE-20 (Improper Input Validation). Because cPanel processes plugin invocations within its Perl runtime, unsanitized values supplied to this parameter can be interpreted and executed as arbitrary Perl code, running under the OS-level identity of the authenticated cPanel user. The vulnerability spans a broad set of maintenance branches captured by CPE strings cpe:2.3:a:webpros:cpanel:*, cpe:2.3:a:webpros:cpanel_(centos_6,_cloudlinux_6):*, and cpe:2.3:a:webpros:wp_sqaured:*, indicating the flaw is present across the vendor's entire active product line including legacy CentOS 6 and CloudLinux 6 builds.
RemediationAI
Upgrade to the patched release for your installed branch: cPanel 11.86.0.43, 11.94.0.30, 11.102.0.41, 11.110.0.117 (or 11.110.0.114 for CentOS 6 / CloudLinux 6 builds), 11.118.0.66, 11.124.0.37, 11.126.0.58, 11.130.0.22, 11.132.0.31, 11.134.0.25, 11.136.0.9, or WP Squared 11.136.1.10 per the WebPros security bulletin at https://support.cpanel.net/hc/en-us/articles/40311426610327. cPanel installations configured for automatic updates should receive these patches without manual intervention. If immediate patching is not feasible, restrict network access to cPanel web ports (typically TCP/2082 and 2083) to only explicitly trusted IP addresses at the network perimeter, reducing the exploitable attacker population to those already on the internal network or allowlist. Additionally, audit and minimize the number of accounts with active cPanel access - since exploitation requires an authenticated session, reducing the account population directly limits exposure. Note that blocking the create_user plugin endpoint specifically may disrupt account provisioning workflows and should be tested in staging before applying in production.
An issue was discovered in cPanel before 11.109.9999.116. Rated medium severity (CVSS 6.1), this vulnerability is remote
cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is
cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488). Rated critical severit
In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554). Rated critical severit
In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549). Rated critical severit
chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497). Rated critical severity (CVSS 9.8), this vulnerability
cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485). Rated critical severit
cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546). Rated critical s
cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544). Rated c
Privilege escalation to SQL root context in cPanel (and WP Squared) occurs when the database-rename operation fails to p
cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543). Rated critical severity (C
cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542). Rated critical sever
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today