PT-2026-38674 · Cpanel · Whm+1

David Hertenstein

·

Published

2026-05-08

·

Updated

2026-05-10

·

CVE-2026-29202

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions cPanel versions prior to 11.136.0.9 cPanel versions prior to 11.136.1.10 (WP Squared) cPanel versions prior to 11.134.0.25 cPanel versions prior to 11.132.0.31 cPanel versions prior to 11.130.0.22 cPanel versions prior to 11.126.0.58 cPanel versions prior to 11.124.0.37 cPanel versions prior to 11.118.0.66 cPanel versions prior to 11.110.0.117 cPanel versions prior to 11.110.0.116 (cl6110) cPanel versions prior to 11.102.0.41 cPanel versions prior to 11.94.0.30 cPanel versions prior to 11.86.0.43
Description Insufficient input validation of the plugin parameter within the create user plugin enables arbitrary Perl code execution. This action is performed on behalf of the system user of the already authenticated account.
Recommendations Update to version 11.136.0.9 or higher. Update to version 11.136.1.10 or higher (WP Squared). Update to version 11.134.0.25 or higher. Update to version 11.132.0.31 or higher. Update to version 11.130.0.22 or higher. Update to version 11.126.0.58 or higher. Update to version 11.124.0.37 or higher. Update to version 11.118.0.66 or higher. Update to version 11.110.0.117 or higher. Update to version 11.110.0.116 or higher (cl6110). Update to version 11.102.0.41 or higher. Update to version 11.94.0.30 or higher. Update to version 11.86.0.43 or higher. Restrict access to WHM management ports 2086 and 2087 to trusted IP addresses. Disable the WHM Terminal UI feature by running touch /var/cpanel/disable whm terminal ui.

Fix

DoS

LPE

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-29202

Affected Products

Whm
Cpanel