CVE-2026-93699: High severity Plesk WP Toolkit for cPanel vulnerability
Published Oct 8, 2026
·Updated
Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server.
Affected Software
1 affected component
Plesk WP Toolkit for cPanel
Event History
Oct 8, 2026
CVE Published
via MITRE·07:38 AM
Data Sourced
via MITRE·07:38 AM
DescriptionWeakness
Data Sourced
via NVD·08:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who is exposed to this issue?
Servers running WP Toolkit for cPanel are exposed where a local user can interact with the vulnerable handler. The issue can enable that user to execute arbitrary code as another account on the same server.
2
What level of access does an attacker need?
An attacker needs local access with low privileges. No user interaction is required, and the attack complexity is low.
3
What is the potential impact if exploitation succeeds?
Successful exploitation can compromise the confidentiality, integrity, and availability of the affected account by allowing arbitrary code execution as that account. The provided CVSS vector does not indicate impacts beyond the vulnerable server's security authority.