Critical · 9.4 CVE-2026-87900 EUVD-2026-85619GHSA-3vmc-c4p8-fp6x

Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute …

Published Sep 23, 2026 · Updated Sep 23, 2026 · Assigned by hackerone

Vendor: WebPros Product: WP Toolkit for cPanel

Description

Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts.

Affected products

Vendor	Product	Affected	Fixed
WebPros	WP Toolkit for cPanel	≤ 6.11.2-10794	—

References

https://support.cpanel.net/hc/en-us/articles/43597969409943