CVE-2026-87900 – WebPros WP Toolkit for cPanel

WebPros has fixed an argument injection flaw in WP Toolkit for cPanel. CVE-2026-87900 has a CVSS score of 9.4, Critical severity. It affects version 6.11.2-10794 and earlier. A remote authenticated user can use it to read arbitrary files and execute arbitrary code across customer accounts.

The danger is in how far it reaches. On shared hosting, a single low-privilege account can cross into other customers' accounts and their WordPress sites. That puts data, site integrity, and tenant isolation at risk. Update WP Toolkit for cPanel to a fixed version the same day.