Multiple vulnerabilities affecting cPanel & WHM

cPanel & WHM is a web hosting management platform providing centralized interfaces for server administration and site hosting. WP Squared (WP2) is a managed WordPress hosting platform based on the technical foundation of cPanel & WHM. These solutions are affected by several vulnerabilities labeled as follows: CVE-2026-29201: This vulnerability arises from an input validation fault during the adminbin call to the feature::LOADFEATUREFILE function. Exploitation of this vulnerability would allow an authenticated attacker to read arbitrary files on the system using unfiltered relative paths. This vulnerability is classified as medium with a severity score of 4.3 according to CVSS v3.1. CVE-2026-29202: This vulnerability is due to insufficient validation of the “plugin” parameter in the “create_user” API call. It would allow an authenticated threat actor to inject and execute arbitrary Perl code with the rights of the system user associated with the authenticated account, opening the door to account compromise and lateral movement on the server. This vulnerability is classified as high with a severity score of 8.8 according to CVSS v3.1. CVE-2026-29203: This vulnerability results from insecure symlink following when executing a chmod operation in the Nova plugin. Exploitation of this vulnerability would allow an authenticated attacker to apply restrictive permissions or assign root privileges to arbitrary files on the system, leading to local escalation of privilege or denial of service. This vulnerability is classified as high with a severity score of 8.8 according to CVSS v3.1.

• cPanel & WHM versions earlier than 11.136.0.9, 11.134.0.25, 11.132.0.31, 11.130.0.22, 11.126.0.58, 11.124.0.37, 11.118.0.66, 11.110.0.117, 11.102.0.41, 11.94.0.30 and 11.86.0.43;
• WP Squared (WP2) versions prior to 11.136.1.10;
• Versions of cPanel & WHM under CentOS 6 or CloudLinux 6 prior to 110.0.114;