Description Summary:
A missing authorization vulnerability in the 2Checkout payment gateway for WHMCS allows unauthenticated attackers to retrieve sensitive customer data via a specific API endpoint.

Executive Summary:
A critical missing authorization flaw in the WHMCS 2Checkout payment gateway exposes sensitive customer information to unauthenticated remote attackers.

Vulnerability Details

CVE-ID: CVE-2026-67398

Affected Software: WebPros WHMCS

Affected Versions: 4.5.0 through 8.12.2, 8.13.0 up to 8.13.8, 9.0.0 up to 9.0.8

Vulnerability: The application fails to perform proper authorization checks within the 2Checkout payment gateway module. This allows an unauthenticated user to interact with a specific endpoint and exfiltrate customer data.

Business Impact

The vulnerability poses a severe risk to data privacy and regulatory compliance. Unauthorized access to customer records can lead to significant reputational damage, potential legal liabilities, and loss of client trust. With a CVSS score of 8.2, this high-severity flaw requires immediate attention to prevent the compromise of sensitive billing and personal information.

Remediation Plan

Immediate Action: Update the WHMCS installation to the latest patched version provided by WebPros as outlined in the vendor security advisory.

Proactive Monitoring: Review access logs for unusual requests directed toward the 2Checkout payment gateway endpoint and monitor for patterns of unauthorized data retrieval.

Compensating Controls: Implement Web Application Firewall (WAF) rules to restrict access to the vulnerable payment gateway endpoint, if an immediate update is not feasible.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Analyst Notes: As of September 4, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's reliance on a missing authorization check makes it a straightforward target for automated scanning once the mechanism is understood.

Analyst Recommendation

Given the exposure of sensitive customer data, this vulnerability must be treated as a high-priority item. Organizations utilizing the 2Checkout gateway within WHMCS should verify their current version against the affected ranges and apply the vendor-supplied patches immediately to ensure the integrity and confidentiality of their customer database.

Description Summary:
A path traversal vulnerability in Plesk allows local users with low privileges to escalate their access and execute arbitrary code with root permissions.

Executive Summary:
A high-severity path traversal vulnerability in Plesk allows authenticated local users to execute arbitrary code as root, posing a critical risk to server integrity.

Vulnerability Details

CVE-ID: CVE-2026-67397

Affected Software: WebPros Plesk

Affected Versions: 0 up to (excluding) 18.0.79.9, 18.0.80 up to (excluding) 18.0.80.5

Vulnerability: The software contains a path traversal flaw (CWE-22) that allows a local, authenticated attacker to manipulate file paths. This vulnerability enables the escalation of privileges, ultimately permitting the execution of arbitrary code with root-level system access.

Business Impact

Successful exploitation of this vulnerability results in a total compromise of the affected Plesk server. Because the attacker can execute code as root, they can bypass all security controls, access sensitive configuration files, modify website content, or install persistent backdoors. With a CVSS score of 8.5, this high-severity flaw demands immediate attention to prevent unauthorized administrative control over the hosting environment.

Remediation Plan

Immediate Action: Review the official Plesk security advisory and apply the latest security updates provided by WebPros to patch the affected versions.

Proactive Monitoring: Monitor system logs for unauthorized attempts to access system directories or unusual process execution patterns initiated by lower-privileged user accounts.

Compensating Controls: Ensure that local user accounts are restricted by using filesystem permissions and monitoring tools to detect unauthorized file access attempts outside of intended user directories.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of September 4, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the exploit requires local access, the resulting impact of root-level code execution makes this a high-priority item for server administrators.

Analyst Recommendation

Given the potential for full root compromise, administrators should prioritize patching their Plesk instances immediately. Until the patch is applied, ensure that local user access to the server is strictly audited and limited to trusted personnel, as the primary vector requires an existing authenticated local session.

Description Summary:
An improper symlink resolution vulnerability in Plesk Migrator and Site Import extensions allows authenticated users to execute arbitrary code as the root user.

Executive Summary:
A high-severity vulnerability in Plesk extensions allows authenticated users to escalate privileges and execute arbitrary code as root through symlink manipulation.

Vulnerability Details

CVE-ID: CVE-2026-65647

Affected Software: WebPros Plesk Migrator and Plesk Site Import

Affected Versions: Plesk Migrator: 0 up to (excluding) 2.36.0, Plesk Site Import: 0 up to (excluding) 1.12.1

Vulnerability: The flaw involves improper symlink resolution during file access operations. An authenticated user can leverage this to trick the system into performing operations on unauthorized files, resulting in root-level code execution.

Business Impact

By enabling an attacker to gain root-level access, this vulnerability poses a severe threat to the entire server environment. This could lead to total system compromise, unauthorized access to all hosted websites, and potential data exfiltration, justifying the high CVSS score of 8.7.

Remediation Plan

Immediate Action: Update the Plesk Migrator extension to version 2.36.0 and the Plesk Site Import extension to version 1.12.1 through the Plesk interface.

Proactive Monitoring: Monitor server logs for unusual file system activity or attempts to create symlinks in restricted directories by non-privileged users.

Compensating Controls: Limit access to the Plesk control panel to trusted IP addresses and enforce the principle of least privilege for all administrative and user accounts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 27, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for authenticated access slightly lowers the risk compared to unauthenticated flaws, but the impact remains severe.

Analyst Recommendation

Administrators should treat this as a high-priority update. Given the risk of root-level execution, it is imperative to update the affected extensions immediately to prevent privilege escalation by potentially malicious internal or compromised user accounts.

Description Summary:
A vulnerability in Plesk allows remote authenticated users to disclose arbitrary local files and escalate their privileges through improper neutralization of special elements in the DNS management module.

Executive Summary:
A critical vulnerability in WebPros Plesk allows authenticated remote attackers to read sensitive local files and achieve privilege escalation, posing a significant risk to server integrity.

Vulnerability Details

CVE-ID: CVE-2026-65646

Affected Software: WebPros Plesk

Affected Versions: WebPros Plesk: 0 up to (excluding) 18.0.79.8, 18.0.80 up to (excluding) 18.0.80.4

Vulnerability: This flaw is caused by CWE-74, which is improper neutralization of special elements in the DNS zone management functionality. The vulnerability requires the attacker to have an authenticated user account to trigger the exploit, which then leads to arbitrary file disclosure and privilege escalation.

Business Impact

The ability for an authenticated user to read arbitrary local files and escalate privileges can lead to a complete compromise of the Plesk management environment. Given the high CVSS score of 8.7, this vulnerability represents a significant threat to data confidentiality and system-wide administrative control, potentially allowing attackers to pivot into other hosted applications or system services.

Remediation Plan

Immediate Action: Administrators must update Plesk to version 18.0.79.8 or 18.0.80.4, or newer, to address the underlying injection flaw.

Proactive Monitoring: Review web server access logs for anomalous requests directed at the DNS zone management interface, particularly those containing unexpected special characters or directory traversal patterns.

Compensating Controls: Implement strict access control policies for the Plesk control panel to ensure only trusted users have access, and utilize a Web Application Firewall to filter malicious input strings if immediate patching is delayed.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 27, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's requirement for authentication limits the initial attack surface, but the high impact of privilege escalation makes it a priority for remediation.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention, as it provides a clear path for authenticated users to gain elevated control over the hosting environment. Organizations should prioritize patching their Plesk installations during the next maintenance window to prevent potential exploitation of this high-risk injection flaw.

Description Summary:
A critical eval injection vulnerability in cPanel allows authenticated remote users to execute arbitrary code with root privileges.

Executive Summary:
An eval injection flaw in cPanel allows authenticated users to achieve remote code execution as root, posing a severe threat to server integrity.

Vulnerability Details

CVE-ID: CVE-2026-65643

Affected Software: WebPros cPanel

Affected Versions: 0 up to 11.110.0.141, 11.112.0.0 up to 11.134.0.53, 11.136.0.0 up to 11.136.0.37, 11.138.0.0 up to 11.138.0.2, 11.138.1.0 up to 11.138.1.7

Vulnerability: This is an improper neutralization of directives in dynamically evaluated code (CWE-95) within the Park API. It allows a remote user with authenticated access to execute arbitrary code on the underlying operating system with root-level privileges.

Business Impact

The ability for an authenticated attacker to gain root access to a cPanel server represents a total compromise of the hosting environment. This level of access permits the exfiltration of sensitive customer data, the installation of persistent backdoors, and the potential disruption of all hosted services. With a CVSS score of 8.7, this vulnerability is classified as High severity and requires immediate remediation to prevent unauthorized system control.

Remediation Plan

Immediate Action: Update your cPanel installation to the latest version, ensuring you have moved beyond the affected ranges (specifically 11.110.0.141, 11.134.0.53, 11.136.0.37, 11.138.0.2, or 11.138.1.7).

Proactive Monitoring: Review system access logs for anomalous behavior in the Park API and monitor for unexpected process execution originating from the cPanel service user.

Compensating Controls: Implement Web Application Firewall (WAF) rules designed to filter malicious input strings directed at the cPanel API endpoints to mitigate potential exploit attempts.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

Analyst Notes: As of September 1, 2026, there is no public information indicating active exploitation in the wild, though a public proof-of-concept is available via GitHub. The nature of eval injection vulnerabilities makes them highly susceptible to weaponization by attackers seeking full system takeover.

Analyst Recommendation

Given the potential for full root compromise, administrators must prioritize patching this vulnerability immediately. Ensure that all cPanel instances are updated to the specified secure versions to eliminate the underlying code injection flaw and protect the integrity of your server infrastructure.

Description Summary:
A vulnerability in the Plesk database management interface allows authenticated users to perform unauthorized read and write operations on databases belonging to other customers.

Executive Summary:
A high-severity insecure direct object reference vulnerability in Plesk allows remote authenticated users to compromise the integrity and confidentiality of other customers' databases.

Vulnerability Details

CVE-ID: CVE-2026-65642

Affected Software: WebPros Plesk

Affected Versions: 0 through 18.0.79.7, 18.0.80 up to 18.0.80.4

Vulnerability: This is an insecure direct object reference (CWE-639) flaw within the Plesk database management interface. The vulnerability permits a remote authenticated user to manipulate database objects belonging to other tenants without proper authorization.

Business Impact

The exploitation of this vulnerability poses a significant risk to data confidentiality and integrity, as unauthorized actors can access or modify sensitive information stored in other customers' databases. Given the CVSS score of 8.6, this flaw is categorized as high severity and requires immediate attention to prevent potential data breaches or service disruption. Failure to remediate this issue could lead to severe reputational damage and loss of trust for hosting providers.

Remediation Plan

Immediate Action: Update Plesk to version 18.0.79.8 or 18.0.80.4 or later immediately to resolve the vulnerable code path.

Proactive Monitoring: Review web access and database management logs for unusual query patterns or unauthorized attempts to access database objects associated with different user accounts.

Compensating Controls: While no direct virtual patch is available, restricting access to the Plesk management interface to trusted IP addresses or internal networks can minimize the attack surface until the update is applied.

Exploitation Status

Public Exploit Available: No (exploit_available is false).

Analyst Notes: As of August 27, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the ease of exploitation through standard interface manipulation, making rapid patching a priority.

Analyst Recommendation

This vulnerability represents a critical risk to multi-tenant environments where database isolation is essential. Security teams must prioritize patching the Plesk installation to the specified secure versions immediately. Given the potential for unauthorized data modification, administrators should also conduct an audit of database access logs following the update to ensure no unauthorized activity occurred prior to remediation.

Description Summary:
Plesk before 18.0.80.1 contains an improper privilege management vulnerability in its XML-RPC API that allows resellers to escalate to administrative root access.

Executive Summary:
An improper privilege management vulnerability in the Plesk XML-RPC API allows authenticated resellers to escalate their privileges to the root administrator.

Vulnerability Details

CVE-ID: CVE-2026-64637

Affected Software: WebPros Plesk

Affected Versions: 0 up to (excluding) 18.0.80.1

Vulnerability: The vulnerability exists in the XML-RPC API due to improper privilege handling. An authenticated reseller can exploit this flaw to bypass restriction checks and obtain a session for the root user account.

Business Impact

The CVSS score of 9.9 underscores the severe impact of this privilege escalation, which grants total control over the server environment. Successful exploitation allows a lower-privileged reseller to gain full administrative rights, potentially leading to total system compromise, unauthorized access to all hosted websites, and complete database control.

Remediation Plan

Immediate Action: Update WebPros Plesk to version 18.0.80.1 or later to apply the necessary security fixes to the XML-RPC API.

Proactive Monitoring: Review administrative audit logs for unusual session activity or suspicious XML-RPC requests originating from reseller accounts.

Compensating Controls: If patching is delayed, restrict access to the XML-RPC API to trusted IP addresses and enforce strong multi-factor authentication for all reseller and administrator accounts.

Exploitation Status

Public Exploit Available: Unknown — there is no confirmed public exploit in the available data.

Analyst Notes: As of August 7, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly severe because it allows a malicious user to bypass security boundaries within a multi-tenant environment.

Analyst Recommendation

Security administrators must update Plesk installations to the specified version immediately to prevent unauthorized privilege escalation. Given the potential for complete system compromise, monitoring for anomalous API usage in the interim is critical to detect potential exploitation attempts.

Description Summary:
An SQL injection vulnerability exists in Plesk Obsidian, potentially allowing an authenticated user to perform unauthorized database operations.

Executive Summary:
A high-severity SQL injection vulnerability in Plesk Obsidian allows authenticated users to execute unauthorized database queries, threatening the integrity of the hosting environment.

Vulnerability Details

CVE-ID: CVE-2026-64636

Affected Software: WebPros Plesk

Affected Versions: WebPros Plesk: 18.0.51 up to (excluding) 18.0.80.1

Vulnerability: This SQL injection vulnerability allows an authenticated attacker to manipulate database queries. The vulnerability is restricted to authenticated users with low privileges, yet the potential impact on the underlying database is significant.

Business Impact

SQL injection poses a severe threat to data confidentiality and integrity, as it can allow unauthorized users to extract sensitive information or modify database contents. With a CVSS score of 7.7, this vulnerability poses a high risk to the security of hosted websites and the management infrastructure of the Plesk environment.

Remediation Plan

Immediate Action: Update Plesk Obsidian to version 18.0.80.1 or later to remediate the SQL injection flaw.

Proactive Monitoring: Enable database query logging to detect anomalous or unauthorized SQL statements and review access logs for signs of attempted exploitation.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires the attacker to be authenticated, which slightly mitigates the risk but does not eliminate it for multi-tenant environments.

Analyst Recommendation

Given the risk of unauthorized database access, applying the vendor patch is the only effective way to fully address this vulnerability. Administrators should prioritize this update to ensure the continued security of the Plesk platform and all hosted data.

Description Summary:
A SQL injection vulnerability in cPanel allows authenticated users with low privileges to execute arbitrary SQL commands in the root context when renaming databases.

Executive Summary:
A critical SQL injection vulnerability in WebPros cPanel allows for privilege escalation to root, posing a severe risk to server integrity.

Vulnerability Details

CVE-ID: CVE-2026-58048

Affected Software: WebPros cPanel

Affected Versions: 11.110.0.137, 11.126.0.78, 11.134.0.48, 11.136.0.32, 11.137.9999.99, 11.118.0.71, 11.138.1.6

Vulnerability: This is a SQL injection flaw where the application fails to properly preserve SQL modes during database renaming operations. An attacker with low-level authenticated access can manipulate this process to execute malicious SQL queries as the root database user.

Business Impact

Successful exploitation allows an attacker to gain full control over the database environment, leading to complete data exfiltration, modification, or destruction. Given the CVSS score of 9.4, this vulnerability represents an extreme risk to confidentiality, integrity, and availability, potentially resulting in total system compromise.

Remediation Plan

Immediate Action: Update cPanel to the latest version as specified in the official WebPros security advisory.

Proactive Monitoring: Audit database logs for unusual rename operations or unexpected query patterns that deviate from established administrative baselines.

Compensating Controls: Implement strict firewall rules to limit access to the cPanel interface to known administrative IP addresses, reducing the attack surface for potential low-privileged accounts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 31, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its ability to escalate privileges to the root level.

Analyst Recommendation

This vulnerability is critical and requires immediate attention to prevent unauthorized administrative control. Security teams must verify their current cPanel version against the patched releases provided by WebPros and apply the updates as a priority to secure the server environment.

Description Summary:
A blind SQL injection vulnerability in the Plesk XML-RPC API allows an authenticated low-privileged user to read arbitrary data from the Plesk database.

Executive Summary:
A critical SQL injection vulnerability in the WebPros Plesk XML-RPC API allows authenticated users to read arbitrary database information and compromise the panel.

Vulnerability Details

CVE-ID: CVE-2026-58046

Affected Software: WebPros Plesk

Affected Versions: 18.0.79.4

Vulnerability: The vulnerability is a blind SQL injection flaw (CWE-89) within the XML-RPC API. It requires the attacker to be authenticated as a low-privileged user, at which point they can manipulate database queries to extract sensitive information.

Business Impact

Successful exploitation can lead to a full compromise of the Plesk management panel, allowing attackers to access sensitive configuration data, user credentials, and potentially administrative controls. The CVSS score of 9.9 underscores the extreme severity, as it facilitates unauthorized data exfiltration and control over the hosting environment.

Remediation Plan

Immediate Action: Update the WebPros Plesk installation to the latest available version to resolve the API vulnerability.

Proactive Monitoring: Review database query logs for unusual patterns, specifically those involving XML-RPC API calls that deviate from standard operational behavior.

Compensating Controls: Restrict access to the Plesk XML-RPC API to authorized network ranges and ensure that low-privileged user accounts are strictly managed and audited.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of Jul 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly exploitable for any authenticated user with access to the API.

Analyst Recommendation

This vulnerability presents a severe risk to the integrity of the Plesk management environment. Administrators must apply the necessary updates provided by WebPros immediately to mitigate the risk of unauthorized database access and potential system-wide compromise.

Description Summary:
WebPros Plesk contains an authorization flaw in the XML-RPC API that allows authenticated customers to access cross-tenant data and plaintext FTP credentials.

Executive Summary:
A critical authorization vulnerability in the WebPros Plesk XML-RPC API allows low-privileged users to access other tenants' cleartext credentials and escalate privileges.

Vulnerability Details

CVE-ID: CVE-2026-56843

Affected Software: Webpros Plesk

Affected Versions: 10.4 up to 18.0.78.4

Vulnerability: The vulnerability is an insufficient protection of credentials (CWE-522) where the XML-RPC API fails to enforce proper ownership checks for specific lookup filters, leading to cross-tenant information disclosure.

Business Impact

With a CVSS score of 9.9, this vulnerability represents a severe risk to multi-tenant environments. An attacker can harvest FTP credentials from other tenants, potentially leading to unauthorized cross-tenant file access and privilege escalation to the system user level, which could result in widespread data breaches across the hosting platform.

Remediation Plan

Immediate Action: Apply the latest security update provided by WebPros to upgrade Plesk to version 18.0.78.4 or later.

Proactive Monitoring: Monitor API access logs for anomalous lookup patterns or unusual XML-RPC requests originating from low-privileged customer accounts.

Compensating Controls: If patching is delayed, restrict access to the XML-RPC API endpoints for untrusted users or implement strict IP-based access controls for API management.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The risk of cross-tenant credential exposure in a hosting environment is extreme. It is imperative that administrators of Plesk instances verify their version and apply the update immediately to prevent unauthorized access to customer data and potential system-wide compromise.

Description Summary:
An improper authorization vulnerability in the Plesk XML API allows authenticated users to inject configuration directives, leading to arbitrary file writes and full root privilege escalation.

Executive Summary:
A critical authorization vulnerability in WebPros Plesk allows authenticated attackers to escalate privileges to root, posing a severe threat to server integrity.

Vulnerability Details

CVE-ID: CVE-2026-48614

Affected Software: WebPros Plesk

Affected Versions: WebPros Plesk: 0 up to (excluding) 18.0.78

Vulnerability: This vulnerability involves an improper authorization flaw within the XML API, which permits an authenticated user to perform unauthorized configuration injections. This results in the ability to write arbitrary files to the filesystem with root-level permissions.

Business Impact

The potential for full privilege escalation to root provides an attacker with complete control over the affected server. Given the CVSS score of 9.9, this vulnerability represents an extreme risk, enabling data exfiltration, service disruption, and the deployment of persistent malicious backdoors.

Remediation Plan

Immediate Action: Upgrade WebPros Plesk to version 18.0.78 or later immediately to resolve the API authorization flaw.

Proactive Monitoring: Review XML API access logs for anomalous configuration requests or suspicious calls originating from low-privileged accounts.

Compensating Controls: Restrict access to the Plesk XML API at the network level to trusted IP addresses only, limiting the attack surface available to unauthorized actors.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it grants full control over the underlying server infrastructure. System administrators must prioritize the update to version 18.0.78 to mitigate the risk of complete system compromise.

Description Summary:
An argument injection vulnerability in WordPress Toolkit allows authenticated users to bypass cross-tenant authorization and execute arbitrary CLI commands as another account.

Executive Summary:
A critical argument injection vulnerability in WordPress Toolkit allows unauthorized command execution, posing a severe risk to multi-tenant environments.

Vulnerability Details

CVE-ID: CVE-2026-47365

Affected Software: cPanel WordPress Toolkit

Affected Versions: WordPress Toolkit before 6.11.0

Vulnerability: The vulnerability exists due to improper input sanitization within the wp-toolkit CLI command structure. It allows a remote authenticated user to manipulate arguments to execute commands across tenant boundaries.

Business Impact

With a CVSS score of 9.9, this vulnerability represents a critical risk to service providers and businesses using shared hosting environments. Successful exploitation allows for privilege escalation and cross-tenant data access, potentially leading to a complete compromise of managed WordPress instances and underlying system integrity.

Remediation Plan

Immediate Action: Update the WordPress Toolkit to version 6.11.0 or later immediately to remediate the argument injection flaw.

Proactive Monitoring: Review system logs for unusual CLI execution patterns or unauthorized attempts to access directories outside of the authenticated user's scope.

Compensating Controls: Implement strict command-line argument validation and monitor for anomalous process spawning originating from the WordPress Toolkit service.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this flaw, administrators must prioritize patching the WordPress Toolkit. Failure to address this could result in unauthorized administrative control over hosted WordPress sites, significantly impacting security posture and customer trust.

Description Summary:
Plesk contains an XPath injection vulnerability in the APS Application Catalog, allowing authenticated users to execute arbitrary OS commands as a low-privileged user.

Executive Summary:
An authenticated XPath injection vulnerability in the Plesk APS Application Catalog enables command execution and local privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-44962

Affected Software: WebPros Plesk

Affected Versions: 18.0.75.1, 18.0.76.2

Vulnerability: The application fails to properly sanitize user-supplied input before passing it into XPath queries (CWE-643). An authenticated, low-privileged user can exploit this to perform XPath injection, leading to arbitrary command execution on the underlying server.

Business Impact

With a CVSS score of 9.9, this vulnerability poses a critical risk to hosting environments. Successful exploitation allows an authenticated attacker to escalate privileges, potentially leading to a full server compromise, unauthorized access to hosted data, and disruption of all services managed by the Plesk instance.

Remediation Plan

Immediate Action: Upgrade to the latest patched version of Plesk as specified in the vendor security advisory.

Proactive Monitoring: Audit server logs for suspicious command execution patterns or abnormal XPath query strings originating from the APS Application Catalog search functionality.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block requests containing malicious XPath injection payloads directed at the catalog search.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability for a low-privileged user to achieve command execution makes this a high-priority update. Organizations should apply the vendor-provided patches immediately to prevent privilege escalation and maintain the integrity of the hosting server.

Description Summary:
An authentication bypass vulnerability in the cPanel and WHM login flow allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Executive Summary:
A critical authentication bypass flaw in cPanel and WHM allows unauthenticated remote attackers to gain full administrative access to the control panel.

Vulnerability Details

CVE-ID: CVE-2026-41940

Affected Software: cPanel and WHM

Affected Versions: Versions after 11.40

Vulnerability: The login mechanism contains a logic flaw that permits unauthenticated access, effectively bypassing the security requirements for accessing the control panel.

Business Impact

With a CVSS score of 9.8, this vulnerability represents an existential risk to any server running the affected software. Unauthorized access to cPanel/WHM grants an attacker full control over the hosted websites, databases, and mail services, leading to catastrophic data loss and service disruption.

Remediation Plan

Immediate Action: Update cPanel and WHM to the latest secure version released by the vendor.

Proactive Monitoring: Inspect server logs for unusual login attempts or successful administrative sessions from unauthorized IP addresses.

Compensating Controls: Restrict access to the cPanel/WHM management ports (typically 2083/2087) using firewall rules to allow only known, trusted administrative IP addresses.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Due to the critical severity and the ease of exploitation, immediate patching is required. Organizations must verify the integrity of their control panel access logs to ensure the vulnerability has not already been leveraged by malicious actors.

Description Summary:
Improper sanitization of the status query parameter in the /unprotected/nova_error endpoint allows unauthenticated attackers to perform CRLF injection.

Executive Summary:
An unauthenticated CRLF injection vulnerability in cPanel and WP Squared enables attackers to inject arbitrary HTTP headers into server responses, facilitating cache poisoning and cross-site scripting.

Vulnerability Details

CVE-ID: CVE-2026-32993

Affected Software: WebPros cPanel and WP Squared

Affected Versions: cPanel versions 11.132.0.0–11.132.0.31, 11.134.0.0–11.134.0.25, 11.136.0.0–11.136.0.9; WP Squared versions 11.132.1.0–11.136.1.11.

Vulnerability: The vulnerability is a CRLF injection (CWE-93) located in the status parameter of the /unprotected/nova_error endpoint. Because the endpoint does not require authentication, an attacker can manipulate HTTP responses to facilitate various web-based attacks.

Business Impact

With a CVSS score of 8.3 (High), this vulnerability poses a significant risk to web infrastructure. CRLF injection can lead to cache poisoning, session hijacking, or cross-site scripting (XSS), potentially impacting the integrity and security of the services managed by cPanel or WP Squared.

Remediation Plan

Immediate Action: Update cPanel and WP Squared installations to the latest patched versions as detailed in the WebPros security advisory.

Proactive Monitoring: Monitor web server access logs for anomalous requests containing carriage return (%0D) or line feed (%0A) characters.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing CRLF sequences in the status query parameter of the affected endpoint.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated, remote nature.

Analyst Recommendation

Administrators must update their cPanel and WP Squared environments immediately to eliminate this injection vector. Given the ease of exploitation, testing and applying the security update should be prioritized to prevent potential web-based attacks.

Description Summary:
SSL verification is disabled in the DNS Cluster system within cPanel and WP Squared, allowing for potential man-in-the-middle attacks.

Executive Summary:
A critical failure in SSL certificate validation within the cPanel and WP Squared DNS Cluster system exposes communications to man-in-the-middle interception and data tampering.

Vulnerability Details

CVE-ID: CVE-2026-32992

Affected Software: WebPros cPanel and WP Squared

Affected Versions: cPanel versions 11.126.0.0–11.136.0.9; WP Squared versions 11.126.1.0–11.136.1.11.

Vulnerability: This is an improper certificate validation vulnerability (CWE-295) affecting the DNS Cluster system. Because the software fails to verify SSL certificates, it is susceptible to man-in-the-middle (MitM) attacks where an attacker can impersonate a DNS cluster node.

Business Impact

With a CVSS score of 8.2 (High), this flaw undermines the fundamental security of DNS cluster communications. An attacker positioned in the network path could intercept or modify sensitive DNS traffic, potentially leading to unauthorized redirection of traffic or credential theft.

Remediation Plan

Immediate Action: Apply the vendor security updates immediately to ensure proper SSL certificate validation is re-enabled across all cluster nodes.

Proactive Monitoring: Review DNS cluster communication logs for signs of connection errors or unusual traffic patterns that might indicate a MitM attempt.

Compensating Controls: Restrict DNS cluster network access to trusted internal IP ranges only, reducing the likelihood of an attacker positioning themselves for a MitM attack.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly sensitive as it effectively bypasses the encryption layer intended to protect cluster communications.

Analyst Recommendation

The severity of this vulnerability necessitates an immediate update. Organizations relying on cPanel or WP Squared DNS clustering must patch to ensure that all inter-node communication is properly authenticated and encrypted, preventing trivial interception by network-level attackers.

Description Summary:
An unauthenticated path traversal vulnerability in cPanel and WP Squared allows attackers to read arbitrary files on the server via the cpdavd attachment download endpoints.

Executive Summary:
An unauthenticated arbitrary file read vulnerability in cPanel and WP Squared poses a critical risk to server confidentiality and system integrity.

Vulnerability Details

CVE-ID: CVE-2026-29205

Affected Software: WebPros cPanel and WP Squared

Affected Versions: See metadata for specific version ranges.

Vulnerability: This is an improper privilege management and path traversal vulnerability residing in the cpdavd attachment download functionality. The vulnerability is exploitable by unauthenticated remote attackers.

Business Impact

The ability for an unauthenticated attacker to read arbitrary files on the server can lead to the exposure of sensitive configuration files, credentials, and system data. Given the CVSS score of 8.6, this vulnerability represents a significant risk of full system compromise, potentially leading to unauthorized access to hosted websites and databases.

Remediation Plan

Immediate Action: Update cPanel and WP Squared to the patched versions specified in the official vendor advisory immediately.

Proactive Monitoring: Monitor server access logs for anomalous requests to the cpdavd service, particularly those containing directory traversal patterns (e.g., ../).

Compensating Controls: Ensure that the cpdavd service is not exposed to the public internet where possible, and utilize a Web Application Firewall (WAF) to block requests containing path traversal sequences.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated nature and the high-privilege context of the affected service.

Analyst Recommendation

This vulnerability is highly critical due to the lack of authentication required for exploitation. Administrators must prioritize patching these systems immediately to prevent unauthorized file access that could serve as a precursor to full server compromise.

Description Summary:
An Insecure Direct Object Reference (IDOR) vulnerability in WebPros WHMCS allows users to access other accounts by manipulating the addonId parameter in clientarea.php.

Executive Summary:
A critical IDOR vulnerability in WebPros WHMCS allows unauthorized access to victim accounts, posing a severe risk to customer data privacy.

Vulnerability Details

CVE-ID: CVE-2026-29204

Affected Software: WebPros WHMCS

Affected Versions: 7.4.0 through 18.12.2, 18.13.0 up to (excluding) 18.13.3, 9.0.0 up to (excluding) 9.0.4

Vulnerability: The vulnerability is an Insecure Direct Object Reference (CWE-639) located in clientarea.php. It allows an authenticated user to submit requests using an arbitrary addonId, bypassing ownership validation and granting unauthorized access to another user's account.

Business Impact

This vulnerability enables horizontal privilege escalation, allowing attackers to view or modify sensitive account information belonging to other customers. With a CVSS score of 9.1, the potential for mass data exfiltration and severe reputational damage is high, as WHMCS is typically used to manage sensitive billing and service data.

Remediation Plan

Immediate Action: Upgrade to the latest patched version of WHMCS (18.13.3, 9.0.4, or later as appropriate for your branch).

Proactive Monitoring: Audit web server access logs for repeated clientarea.php requests that reference varying addonId values from a single session.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block suspicious IDOR patterns or unauthorized parameter manipulation in client-side requests.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous because it allows for unauthorized access without needing elevated privileges, relying solely on predictable object references.

Analyst Recommendation

Due to the critical nature of this IDOR vulnerability, administrators must apply the vendor-provided patches immediately. Failure to address this flaw could lead to a widespread compromise of customer accounts, necessitating significant incident response efforts and potential regulatory reporting.

Description Summary:
A symlink vulnerability in the cPanel Nova plugin's Cpanel::Nova::Connector allows for unauthorized modification of system file permissions.

Executive Summary:
A critical symlink vulnerability in the cPanel Nova plugin enables unauthorized modification of sensitive system files, potentially leading to full administrative takeover.

Vulnerability Details

CVE-ID: CVE-2026-29203

Affected Software: cPanel Nova Plugin (Cpanel::Nova::Connector)

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists due to a chmod call in the Cpanel::Nova::Connector that fails to properly handle symlinks. This allows an attacker to manipulate system file permissions, including those of sensitive root-owned files or directories.

Business Impact

A CVSS score of 8.8 underscores the gravity of this issue, as it permits attackers to override system security configurations. Exploiting this flaw can lead to unauthorized data access, privilege escalation, and the potential for complete system takeover by altering critical configuration files.

Remediation Plan

Immediate Action: Apply the vendor-provided security patch for the cPanel Nova plugin immediately to resolve the symlink handling error.

Proactive Monitoring: Monitor for unexpected changes to file permissions on critical system directories and review logs for any unauthorized use of the Nova connector.

Compensating Controls: Ensure that the web server process runs with the least privilege necessary and utilize file integrity monitoring (FIM) tools to detect unauthorized modifications.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, the risk of arbitrary permission modification makes this a critical security concern for server infrastructure.

Analyst Recommendation

This vulnerability represents a significant risk to server integrity. Administrators must prioritize updating the cPanel Nova plugin to prevent attackers from leveraging this flaw to gain unauthorized administrative permissions on the server.

Description Summary:
Insufficient input validation in the cPanel Nova plugin's create_user function allows for arbitrary Perl code execution.

Executive Summary:
A critical vulnerability in the cPanel Nova plugin allows authenticated users to execute arbitrary Perl code, leading to potential full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-29202

Affected Software: cPanel Nova Plugin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability stems from insufficient input validation of the plugin parameter within the create_user function. This flaw allows an authenticated account holder to execute arbitrary Perl code with the privileges of the system user running the plugin.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe threat to hosting environments. Successful exploitation allows for privilege escalation and arbitrary code execution, enabling an attacker to gain full control over the server and access all hosted data.

Remediation Plan

Immediate Action: Update the cPanel Nova plugin to the latest vendor-provided version that includes the input validation patch.

Proactive Monitoring: Inspect system logs for unexpected execution of Perl scripts or anomalous processes initiated by the cPanel user.

Compensating Controls: Temporarily disable the create_user functionality within the Nova plugin if a patch cannot be immediately deployed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, the ability to execute code on the host system makes this a high-priority target for attackers.

Analyst Recommendation

The severity of this remote code execution flaw requires immediate patching. Administrators should audit their cPanel environments for the presence of the Nova plugin and ensure all updates are applied to mitigate the risk of server-wide compromise.