Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.

1. CRITICAL INFRASTRUCTURE: cPanel Local Privilege Escalation

A critical vulnerability in cPanel & WHM allows a standard hosting account to escalate privileges to root. The flaw resides in the CalDAV and CardDAV services, which handle calendars and contacts for individual accounts [11]. A separate vulnerability also allows accounts to modify databases belonging to other users on the same server [7].

• CVE-2026-87899 — CVSS: 9.8 (Critical)
• Affected versions: cPanel & WHM versions prior to 120.0.12 and 118.0.21 [7], [10]
• Fixed in: 120.0.12, 118.0.21, and 110.0.35 (LTS) [7]
• Action now:
  • Run /scripts/upcp immediately to update to a patched tier.
  • Update WP Toolkit via the cPanel interface or package manager [10].
  • Audit recent root-level activity and check for unauthorized /usr/local/cpanel/ modifications.

2. CMS CORE: Active Exploitation of WordPress RCE

Attackers have begun active exploitation of a newly disclosed unauthenticated path traversal vulnerability in WordPress core [2], [6]. By manipulating file paths, attackers are utilizing pearcmd.php to write malicious PHP files to the server, resulting in full Remote Code Execution (RCE) [2], [5]. Proof-of-Concept (PoC) code is now publicly available, significantly increasing the volume of automated attacks [1].

• CVE-2026-87902 — CVSS: 9.2 (Critical)
• Affected versions: WordPress core 7.0.x, 7.1.0, and 7.1.1 [3], [5]
• Fixed in: WordPress 7.1.2 [3]
• Action now:
  • Update to WordPress 7.1.2 immediately using wp core update or the dashboard.
  • Disable register_argc_argv in php.ini to mitigate pearcmd.php exploitation vectors.
  • Scan for new or suspicious PHP files in /wp-content/uploads/ and /tmp/ directories.

3. PLUGIN VULNERABILITIES: WP Team & PublishPress

Several widely used WordPress plugins have disclosed high-severity vulnerabilities. Infrastructure teams should note the IDOR vulnerability in TLP Team, which could allow unauthorized data access, and a CSRF flaw in PublishPress Capabilities that could lead to unauthorized privilege changes if an admin is social-engineered [12], [13].

• TLP Team Plugin (IDOR): Affected <= 6.0.0; Fixed version not disclosed in sources [12].
• PublishPress Capabilities (CSRF): Affected <= 2.50.1; Fixed version not disclosed in sources [13].
• Premium Addons for Elementor (XSS): Affected <= 4.11.105; Fixed version not disclosed in sources [14].
• Action now:
  • Update TLP Team, PublishPress Capabilities, and Premium Addons for Elementor to the latest available versions via wp plugin update.
  • If no update is available, consider temporary deactivation of the TLP Team plugin until a patch is released.