CVE-2026-93699CWE-88

CVE-2026-93699

published October 8, 2026

CVSS
8.5
EPSS
0%
Percentile
2.6
In the wild
Unconfirmed
What it is

Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server.

The record
Technical detail
CVSS
8.5 · NONE
CVSS v4.0
8.5 · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00134 · 2.6th percentile
Weakness
CWE-88 · Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Published
2026-10-08T12:16Z
References (1)
https://support.cpanel.net/hc/en-us/articles/43874620756759-Security-CVE-2026-93699-Vulnerability-in-WP-Toolkit-s-Handler-September-30-2026 · [email protected]
EPSS history
Timeline
  • 09 OCT 03:32Z
    EPSS moved — → 0%
    epss
  • 08 OCT 07:38Z
    Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server
    cvelistv5
  • 08 OCT 07:38Z
    Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server
    cvelistv5