CVE-2026-93699: WP Toolkit 6.11.3 Still Runs Code as Other Accounts - Patch 6.11.4
The Situation
HackerOne published CVE-2026-93699 on 8 October 2026 (datePublished 2026-10-08T07:38:08.237Z). The CNA one-liner, verbatim:[3]
Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server.
cPanel's own advisory is the ticket language unless you have extra evidence. Title: Security: CVE-2026-93699 Vulnerability in WP Toolkit's Handler - October 1, 2026 (KB updated 2026-10-07T13:15:33Z). Situation: a security issue in WP Toolkit's handler which can lead to execution of arbitrary code. Impact, verbatim: a user can perform arbitrary code execution as any other user on the server that owns a domain.[1]
Facts that are on the records, not our lab:
- Product (CNA): WebPros WP Toolkit, versions
0lessThan6.11.4(versionTypesemver). Description names WP Toolkit for cPanel. Vendor table: affected v6.11.3 and older, patched v6.11.4 or later.[1][3] - CWE-88 argument injection.[2][3]
- CVSS 4.0 8.5 HIGH -
AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N(HackerOne CNA). Subsequent CIA is None. That is not last week's 9.4 with subsequent-High.[2][3] - Finder credit: rz1027.[3]
- CISA ADP Vulnrichment on the CVE JSON (
dateUpdated2026-10-08T17:23:05.936Z): Exploitation: none, Automatable: no, Technical Impact: total.[3] - GitHub's unreviewed advisory GHSA-fh55-xx6c-9h8v mirrors the same CNA text, 8.5, and CWE-88. EPSS on that record: 0.134% / 2.5th percentile - a ranking, not a hunt.[4]
This is not CVE-2026-87900 (WP Toolkit database-create, floor 6.11.3).[6] A box that already ran the 6.11.3 installer is still in range for 93699. The vendor table says so: v6.11.3 and older.[1]
Version floor
| Source | Affected | First patched |
|---|---|---|
| cPanel KB | WP Toolkit v6.11.3 and older | v6.11.4 or later |
| CNA CPE | WP Toolkit 0 lessThan 6.11.4 |
6.11.4 |
The package name cPanel documents for this product is wp-toolkit-cpanel. Check what the box actually has:
rpm -q wp-toolkit-cpanel
# Ubuntu / apt boxes:
dpkg -l wp-toolkit-cpanel
Anything that prints 6.11.3 or older is still on the vulnerable handler. If the package is missing, WP Toolkit is not installed and this CVE does not apply - do not "patch" a ghost.
We are not claiming a CLI --version flag; we did not run the installer. The RPM/DPKG query is the check.
Patch - the command from cPanel's advisory, verbatim
cPanel's call-to-action (including the missing "c" in "You an update") is a root installer from Plesk's WP Toolkit CDN:[1]
bash <(curl https://wp-toolkit.plesk.com/cPanel/installer.sh || wget -O - https://wp-toolkit.plesk.com/cPanel/installer.sh) --version 6.11.4
Read that script before you pipe it. It is root, it writes apt/yum repo files, and --version 6.11.4 is what the advisory names. After it returns:
rpm -q wp-toolkit-cpanel
# expect 6.11.4 or newer
Do not take a WHM tile that says "WP Toolkit" as proof of the build. The package NEVRA is the proof. Do not stop at 6.11.3 because you already closed CVE-2026-87900.
Why this is a shared-hosting problem anyway
WP Toolkit is the panel helper that creates the WordPress install, database, and grants when a cPanel account clicks Install. Argument injection on a handler is not a WordPress plugin bug. It is the provisioning binary that already runs next to every tenant's files.
Read the two impact statements before you paste "unauth RCE" into a ticket:
- Vendor: a user → arbitrary code execution as any other user on the server that owns a domain. Isolation failure at the Unix UID layer. Customer A can run as Customer B. That is enough to plant a plugin, dump
wp-config.php, or brick the shop.[1] - CNA / NVD / GHSA: local users → execute arbitrary code as other accounts on the same server. Same CWE-88. Vector is AV:L, not AV:N.[2][3]
AV:L / PR:L - this is not last week's database-create bug (CVE-2026-87900 was CNA AV:N). You need a local execution context on the box: a jail/shell, a popped PHP site that can exec, a cron, an SSH user. UI:N / AT:N / AC:L - no click, no special timing once you are local. Automatable: no is CISA's SSVC, not "hard." They scored it that way because it needs a local principal.[3]
SC:N/SI:N/SA:N - CNA did not encode subsequent-system High this time. Do not copy last week's 9.4 vector onto this CVE. The vendor impact is still other accounts that own a domain. On shared hosting that is the neighboring WordPress, not "only your own files."[1][3]
We are not publishing a PoC. The advisory does not name the injected flag, the handler binary, or a log signature.
Honesty / What We Could Not Verify
- Exploitation status: CISA ADP on 8 Oct 2026 is
Exploitation: none. Not in KEV as of catalog 2026.10.08 (dateReleased2026-10-08T20:09:18.9833Z, 1739 entries). That day's KEV adds were ProFTPD CVE-2015-3306, BIND CVE-2015-5477, Struts CVE-2016-3081, ONLYOFFICE CVE-2021-3199, and Strapi CVE-2023-22894 - not this CVE. Absence from KEV is not "nobody will try it from a rented cPanel shell."[5] - Local vs panel login: vendor text is "a user." CNA is "local users" with AV:L. We do not know whether a cPanel web session without shell is enough. Do not write "any $5 account via :2083" as a mitigator or as a threat model until WebPros says so.
- Not root. Vendor impact is other domain-owning users, not
uid=0. Do not file this next to CalDAV/Multilang tenant-to-root. - 6.11.3 is not the floor. CVE-2026-87900's patch is 6.11.3. This CVE's vendor table includes 6.11.3 as affected. We did not bisect builds between 6.11.3-10850 and 6.11.4.[1][6]
- Plesk WP Toolkit is a different distribution. The CNA description says for cPanel. The installer URL in the advisory is the cPanel CDN path. Do not close a Plesk ticket with this command.
- EPSS 0.134% on GHSA is a model output, not a measurement of scanners in the wild.[4]
- This lab: we did not run these commands against a live cPanel box for this post. Copy-paste from the vendor pages cited below.
Hunt, then patch
Temporary, not a substitute for 6.11.4:
- Inventory who has WP Toolkit at all (
rpm -q wp-toolkit-cpanel). Boxes without the package are out of scope. - Restrict shell / jail / SSH to accounts you do not trust while you roll the fleet. This bug is AV:L.
- After 6.11.4: look the way you would after any cross-account exec - new files in other homes owned by the WP Toolkit user, unexpected
wp-content/mu-plugins, crontab noise. cPanel did not publish an indicator unique to this CVE. We are not inventing one.
Fleet one-liner:
for h in $(cat hosts.txt); do
ssh root@$h 'rpm -q wp-toolkit-cpanel 2>/dev/null || dpkg -l wp-toolkit-cpanel 2>/dev/null | awk "/^ii/{print}" || echo not-installed' | sed "s|^|$h: |"
done
Anything 6.11.3 or older goes in the patch window this week.
What this is not
- Not CVE-2026-87900 (WP Toolkit database-create, floor 6.11.3). Same package, newer floor.
- Not CVE-2026-93698 (Multilang adminbin, account-to-root, cPanel 11.138.0.11). Different binary.
- Not CVE-2026-87902 (WordPress core page-template). A site on a patched WordPress core can still be provisioned by a vulnerable WP Toolkit.
- Not a CISA three-day clock. Patch because the helper that sits next to every WordPress on the box has a local cross-account CWE-88 with technical impact total, not because BOD 26-04 named it.
Sources
[1] https://support.cpanel.net/hc/en-us/articles/43874620756759-Security-CVE-2026-93699-Vulnerability-in-WP-Toolkit-s-Handler-October-1-2026 - cPanel CVE-2026-93699 WP Toolkit handler [2] https://nvd.nist.gov/vuln/detail/CVE-2026-93699 - NVD CVE-2026-93699 [3] https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93699.json - CVE 5.2 record CVE-2026-93699 [4] https://github.com/advisories/GHSA-fh55-xx6c-9h8v - GHSA-fh55-xx6c-9h8v [5] https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json - CISA KEV catalog JSON [6] https://support.cpanel.net/hc/en-us/articles/43597969409943-Security-CVE-2026-87900-Vulnerability-in-WP-Toolkit-Database-Creation-September-22-2026 - cPanel CVE-2026-87900