# CVE-2026-87900

Authenticated argument-injection in cPanel WP Toolkit allows cross-account RCE and file read

- Page: https://www.vulneraibility.com/cve/CVE-2026-87900
- CVSS: 9.4
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.65% (percentile 51.6)
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2026-09-23)
- Weakness: CWE-88
- Published: 2026-09-23

## Affected versions

- WebPros WP Toolkit for cPanel: affected <= 6.11.2-10794; fixed in < 6.11.3-10850

A version outside these ranges is not a statement that it is unaffected.

## Impact

Authenticated remote code execution and arbitrary file read across customer accounts via argument injection, enabling account takeover and data theft.

## Action

Immediate action required

## Recommendation

Restrict WP Toolkit/admin access, isolate affected servers, rotate admin creds; apply vendor patch when released.

## References

- [other] https://support.cpanel.net/hc/en-us/articles/43597969409943

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.