WP Toolkit: Argument injection enables local code execution as other accounts
Summary
WP Toolkit for cPanel contains an argument injection flaw (CWE-88). A local user with a valid cPanel login can use it to execute arbitrary code as other accounts on the same server. The CNA-based CVSS score is 8.5 (v4.0, High). The risk is highest on shared-hosting servers where tenants are not fully trusted, because cross-account code execution breaks tenant isolation.
Affected
- WP Toolkit (WebPros, for cPanel) versions 0 to before 6.11.4 according to the CVE record
- Plesk builds: unknown
Fixed in
- WP Toolkit 6.11.4 or later (fix stated in a third-party changelog; not yet confirmed in the vendor advisory)
Workaround
- Unknown. No workaround is documented for this CVE. Upgrading to 6.11.4 is the fix.
Exploitation
- No evidence of exploitation found.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- Not listed in CISA KEV. EPSS is low.
- No public proof of concept found; this is absence of evidence, not confirmation.
Our recommendation
- Check whether WP Toolkit (wp-toolkit-cpanel) is installed and update it to 6.11.4 or later.
- Review which cPanel accounts exist and who controls them, and restrict WP Toolkit access to trusted administrators.
- Prioritise shared-hosting servers with untrusted tenants.
- Monitor for unexpected processes or file changes under other accounts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- cPanel security advisory CVE-2026-93699 support.cpanel.net
- Strix CVE-2026-93699 www.strix.ai
- PSIRT CVE-2026-93699 psirt.com
- Creoline WP Toolkit extension (changelog) marketplace.creoline.com
- Vulners Rapid7 CVE-2026-93699 (EPSS) vulners.com
- OffSeq Radar CVE-2026-93699 radar.offseq.com
- The Hacker News: cPanel flaw lets hosting account holders thehackernews.com
- CloudMinister cPanel security update September 2026 cloudminister.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:10.
Original description (NVD)
Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.