Insufficient Input Validation in cPanel Leads to Arbitrary Code Execution
CVE-2026-29202

5.3MEDIUM

Key Information:

Vendor

Webpros

Status
Cpanel
Cpanel (cloudlinux 6, Centos 6)
WP Squared
Vendor
CVE Published:
8 May 2026

Badges

📈 Trended📈 Score: 2,300👾 Exploit Exists📰 News Worthy

What is CVE-2026-29202?

CVE-2026-29202 is a critical vulnerability identified in cPanel, a widely-used web hosting control panel designed to simplify server management for website owners and administrators. This vulnerability stems from insufficient input validation in the plugin parameter of the create_user function, allowing authenticated users to execute arbitrary Perl code on the server where cPanel is hosted. The risk associated with this vulnerability lies in its capacity to undermine the integrity of the web hosting environment, potentially enabling attackers to manipulate server functions or access sensitive data.

Given that cPanel is an integral component for managing domains, files, and databases, the exploitation of this vulnerability can lead to severe repercussions for organizations that rely on its services. Attackers may leverage this flaw to escalate privileges, disrupt services, or deploy malware, thereby compromising the overall security posture of affected systems.

Potential impact of CVE-2026-29202

  1. Arbitrary Code Execution: The vulnerability allows attackers to run arbitrary Perl code, which can lead to unauthorized access and control over critical server components, putting sensitive data and system integrity at significant risk.

  2. Privilege Escalation: Since the flaw occurs within an authenticated context, it enables users with existing credentials to execute malicious commands, leading to potential privilege escalation and further exploitation of the hosting environment.

  3. Data Breach and System Compromise: Exploiting this vulnerability could result in unauthorized access to databases and user information, heightening the risk of data breaches and enabling attackers to deploy further malicious activities, such as ransomware or other forms of malware.

Affected Version(s)

cPanel 11.136.0.0 < 11.136.0.9

cPanel 11.134.0.0 < 11.134.0.25

cPanel 11.132.0.0 < 11.132.0.31

News Articles

favicon imageCybersecuritynews

New cPanel and WHM Flaws Enable Code Execution, DoS Attacks

cPanel has disclosed three critical security vulnerabilities tracked as CVE-2026-29201, CVE-2026-29202, and CVE-2026-29203 affecting its widely deployed cPanel & WHM web hosting control panel and WP Squared (WP2) platform.

1 month ago

References

https://support.cpanel.net/hc/en-us/articles/403114266103...

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 📈

    Vulnerability started trending

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by Cybersecuritynews

  • Vulnerability published

  • Vulnerability Reserved

.