CVE-2026-87900: cPanel WP Toolkit database-create is account-to-account - patch 6.11.3

The Situation

HackerOne published CVE-2026-87900 on 23 September 2026 (datePublished 2026-09-23T19:52:47.153Z). The CNA one-liner, verbatim:

Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts.

cPanel's own advisory is narrower, and that is the text you should put on a customer ticket unless you have extra evidence. Title: Security: CVE-2026-87900 Vulnerability in WP Toolkit Database Creation - September 22, 2026. Situation, verbatim: a security issue in the handling of database-creation commands in WP Toolkit. Impact, verbatim: an authenticated cPanel user can perform database modifications in other accounts.

Facts that are on the records, not our lab:

Product (CNA): WebPros WP Toolkit for cPanel, versions 0 lessThanOrEqual 6.11.2-10794. CNA also lists 6.11.3-10850 as an unaffected version. Vendor patched line is 6.11.3 or later.
CWE-88 argument injection.
CVSS 4.0 9.4 CRITICAL - AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H (HackerOne CNA). Subsequent confidentiality/integrity/availability (SC/SI/SA) are High - that is how they encoded "across customer accounts."
Finder credit: Ali Mustafa (rz1027).
CISA ADP Vulnrichment on the CVE JSON (updated 2026-09-23T20:05:57.710Z): Exploitation: none, Automatable: no, Technical Impact: total. That is SSVC annotation, not a KEV listing.

Primary sources:

CVE-2026-87900 JSON / NVD
GHSA-3vmc-c4p8-fp6x
cPanel advisory 43597969409943 (Zendesk JSON: /api/v2/help_center/en-us/articles/43597969409943.json)

This is not last week's cPanel CalDAV tenant-to-root (CVE-2026-87899) and not WP Toolkit-for-Plesk on a Plesk box. Different binary, different floor, different inventory command. A server that already ate 11.138.0.8 can still be sitting on WP Toolkit 6.11.2-10794.

Version floor

Affected: WP Toolkit for cPanel ≤ 6.11.2-10794 (CNA and the cPanel table agree on that build).
Fixed: vendor 6.11.3 or later. CNA's named-good build is 6.11.3-10850. If rpm -q prints a 6.11.3 build below 10850, treat it as unverified against this CPE and still run the vendor installer.

The package name cPanel documents for this product is wp-toolkit-cpanel (see their CageFS install article). Check what the box actually has:

rpm -q wp-toolkit-cpanel
# Ubuntu / apt boxes:
dpkg -l wp-toolkit-cpanel

Anything that prints 6.11.2-10794 or older is still on the vulnerable database-create path. If the package is missing, WP Toolkit is not installed and this CVE does not apply - do not "patch" a ghost.

The install lives under /usr/local/cpanel/3rdparty/wp-toolkit/ (cPanel's own CageFS article names that home and the wp-toolkit system user). We are not claiming a CLI --version flag; we did not run the installer. The RPM/DPKG query is the check.

Patch - the command from cPanel's advisory, verbatim

cPanel's call-to-action (typo and all) is a root installer from Plesk's WP Toolkit CDN:

bash <(curl https://wp-toolkit.plesk.com/cPanel/installer.sh || wget -O - https://wp-toolkit.plesk.com/cPanel/installer.sh) --version 6.11.3

Read that script before you pipe it. It is root, it writes apt/yum repo files, and --version 6.11.3 is what the advisory names. After it returns:

rpm -q wp-toolkit-cpanel
# expect 6.11.3 or newer; CNA's named-good build is 6.11.3-10850

Do not take a WHM tile that says "WP Toolkit" as proof of the build. The package NEVRA is the proof.

Why this is a shared-hosting problem anyway

WP Toolkit is the panel feature that creates the WordPress database, user, and grants when a cPanel account clicks Install. Argument injection on that path is not a WordPress plugin bug. It is the provisioning helper that already holds DB credentials for the box.

Read the two impact statements side by side before you paste "RCE" into a ticket:

Vendor: authenticated cPanel user → database modifications in other accounts. Isolation failure at the MySQL layer. Customer A can change Customer B's WordPress database. That is enough to plant an admin user, dump tables, or brick the shop.
CNA / NVD / GHSA: authenticated user → read arbitrary files and execute arbitrary code across customer accounts. Same CWE-88, wider claim. They did not publish a gadget chain.

PR:L - you need a cPanel login. On shared hosting that is a $5/month account or any popped WordPress on the box. UI:N / AT:N / AC:L - no click, no special timing. Automatable: no is CISA's SSVC, not "hard." They scored it that way because it needs a credential.

We are not publishing a PoC. The advisory does not name the injected flag, the wrapper binary, or a log signature.

Honesty

Labeled as such, because this is the part people over-claim:

Not in CISA KEV as of catalogVersion 2026.10.04 (dateReleased 2026-10-04T18:52:56Z). Today's KEV add was Citrix NetScaler CVE-2026-88779. We are not treating 87900 as "actively exploited" on that list.
CISA ADP says Exploitation: none as of 23 Sep 2026. We have no public hunt volume for this CVE to cite. Absence of a public scanner is not evidence nobody is trying it from a rented cPanel account.
9.4 is CNA CVSS 4.0, not a 3.1. Do not convert it in your head to "9.8 unauth." The vector is PR:L.
Vendor impact (other-account database modifications) and CNA impact (file read + RCE across accounts) disagree. We did not reproduce either. Ticket language: vendor's sentence, plus "NVD also claims file read/RCE; unverified here."
The CNA unaffected object is sloppy CVE 5.x (lessThan 6.11.3-10850 on an unaffected row). Trust the vendor table (6.11.3 or later) and confirm the RPM build; do not parse that lessThan as "everything below 10850 is fine."
Plesk WP Toolkit is a different distribution. This CVE's CPE is WP Toolkit for cPanel. Do not close a Plesk ticket with this installer URL.
We did not verify whether 6.11.3 without the -10850 suffix is bit-for-bit the CNA's named-good build. If rpm -q returns 6.11.3 with a lower release, still run the advisory command and re-check.

Hunt, then patch

Temporary, not a substitute for 6.11.3:

Inventory who has WP Toolkit at all (rpm -q wp-toolkit-cpanel). Boxes without the package are out of scope.
Restrict cPanel account creation / resellers you do not trust while you roll the fleet. This bug is PR:L.
After 6.11.3: look at MySQL history the way you would after any cross-account DB bug - new GRANTs, new users in other people's wp_users, unexpected DROP/CREATE from the WP Toolkit system user. cPanel did not publish an indicator unique to this CVE. We are not inventing one.

Fleet one-liner:

for h in $(cat hosts.txt); do
  ssh root@$h 'rpm -q wp-toolkit-cpanel 2>/dev/null || dpkg -l wp-toolkit-cpanel 2>/dev/null | awk "/^ii/{print}" || echo not-installed' | sed "s|^|$h: |"
done

Anything ≤ 6.11.2-10794 goes in the patch window this week.

What this is not

Not CVE-2026-87899 (cPanel CalDAV account-to-root). Different component, different floor (11.138.0.8).
Not CVE-2026-87902 (WordPress core page-template / PEAR). Different product. A site on WP 7.1.2 can still be provisioned by a vulnerable WP Toolkit.
Not a CISA three-day clock. Patch because the helper that creates every WordPress database on the box has a 9.4 CNA score with subsequent-system High, not because BOD 26-04 named it.