WebPros cPanel & WHM: OS command injection in Multilang adminbin

Summary

Insufficient input validation in the Multilang adminbin, a privileged helper in cPanel & WHM, allows arbitrary operating system commands to be executed. The CVSS vector requires low privileges (PR:L), so an attacker needs a valid cPanel account, which on shared hosting may be held by any tenant. Successful exploitation can lead to command execution as root, with full control over the server and possibly other hosted customers. WP Squared is affected in the same way.

Affected

• cPanel & WHM builds below 11.138.0.11, 11.136.0.45, 11.134.0.61 and 11.110.0.148
• WP Squared builds below 11.138.1.13

Fixed in

• Upgrade to cPanel & WHM 11.138.0.11, 11.136.0.45, 11.134.0.61 or 11.110.0.148 or later (changelog entries 110.0.148 and 134.0.61 are part of the September 29, 2026 targeted security release; the vendor advisory lists the other branches)
• Upgrade WP Squared to 11.138.1.13 or later

Workaround

Unknown. The vendor has not published a workaround; the vendor advisory recommends patching. Restricting access to admin interfaces is at most a partial control, because the flaw can be reached from within a hosting account.

Exploitation

• No confirmed exploitation in the wild found at the time of research.
• Not listed in the CISA KEV catalog. CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof-of-concept found.
• Sources disagree on the prerequisites; the CVSS vector indicates an authenticated low-privilege user.

Our recommendation

• Patch all cPanel & WHM and WP Squared servers to the fixed versions as soon as possible, ideally within the next maintenance window.
• If you only use managed hosting, ask your provider to confirm the patch date in writing.
• Review which accounts and resellers have cPanel or WHM access and remove unused accounts.
• Monitor for unexpected child processes spawned by the Multilang adminbin or related cPanel helper processes, and review unusual parameter combinations to adminbin endpoints.
• Check the vendor advisory directly for final version numbers, as this entry was compiled from third-party coverage.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE-2026-93698 Vendor advisory (cPanel support) support.cpanel.net
• cPanel & WHM 110 Change Log docs.cpanel.net
• cPanel & WHM 134 Change Log docs.cpanel.net
• cPanel & WHM 136 Change Log docs.cpanel.net
• cPanel & WHM 138 Change Log docs.cpanel.net
• WP Squared Change Log docs.wpsquared.com
• HackerOne report hackerone.com
• VulDB CVE-2026-93698 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:45.