MSRXcPanel & WHM vulnerabilities
3 cPanel & WHM flaws were confirmed exploited in the wild in the past 365 days, 1 used in ransomware. Patch these first.
| Added | Exploited vulnerability | Fix by |
|---|---|---|
| 2026-06-15 | CVE-2026-54420 LiteSpeed cPanel Plugin LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability LiteSpeed cPanel plugin contains a UNIX symbolic link (Symlink) following vulnerability that could allow a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS. | 2026-06-18 |
| 2026-05-26 | CVE-2026-48172 LiteSpeed cPanel Plugin LiteSpeed cPanel Plugin Privilege Escalation Vulnerability LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges. | 2026-05-29 |
| 2026-04-30 | CVE-2026-41940 WebPros cPanel & WHM and WP2 (WordPress Squared) ransomwareWebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. | 2026-05-03 |
Newest cPanel & WHM CVEs
7 of 7 in NVD| 2026-09-17 | CVE-2026-87886exploited Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238. | 7.8 |
| 2026-06-12 | CVE-2026-47365 Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cross-tenant authorization and execute arbitrary wp-toolkit CLI commands as another account. | 9.9 |
| 2025-02-27 | CVE-2025-24832 Arbitrary file overwrite during home directory recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.8.4.866, Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.1.892, Acronis Backup extension for Plesk (Linux) be | 5.5 |
| 2024-11-11 | CVE-2024-34015 Sensitive information disclosure during file browsing due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.8.3.818, Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.1.892. | 3.3 |
| 2024-11-11 | CVE-2024-34014 Arbitrary file overwrite during recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.8.3.818, Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.1.892, Acronis Backup extension for Plesk (Linux) before build 1.8. | 5.5 |
| 2024-09-17 | CVE-2024-8767 Sensitive data disclosure and manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 619, Acronis Backup extension for Plesk (Linux) before build 555, Acronis Backup plugin for DirectAdmin (Linux) before build 147. | 9.9 |
| 2020-02-10 | CVE-2012-6449 The clientconf.html and detailbw.html pages in x3 in cPanel & WHM 11.34.0 (build 8) have a XSS vulnerability. | 5.4 |
Keyword search in the US National Vulnerability Database, so it can include products that merely mention cPanel & WHM.
Source: CISA Known Exploited Vulnerabilities catalog 2026.10.28 (live), refreshed every 12 hours.