cPanel disclosed three new vulnerabilities on September 22, and the most serious one, again, lets an ordinary hosting account holder run code as root and take full control of the server. No special access needed, no privilege escalation trick, just a regular cPanel account and a flaw in the CalDAV and CardDAV service that handles calendars and contacts.
That’s genuinely dangerous on shared hosting, where a single provider sells accounts to the public. Anyone who signs up, or anyone who gets hold of someone else’s login, could reach the same access a server administrator has. The second flaw sits inside WP Toolkit, the plugin many providers use to manage WordPress installations, and lets a logged-in user modify databases belonging to other accounts entirely.
cPanel hasn’t said exactly what changes are possible or whether data from those other accounts can also be read, which leaves a fairly wide gap in what administrators actually know they’re patching. A third, less severe flaw in the same calendar service lets a local user read other accounts’ calendar and contact data, though not modify it or gain root.
All three trace back to the same researcher, Ali Mustafa, who goes by rz1027 online. Vendor records now credit him with at least seven cPanel and Plesk vulnerabilities disclosed since August 27, three shared with another researcher known as abed1526. This particular root-access pattern, an ordinary account escalating all the way to full server control, has now shown up four separate times this cycle, most recently in a September 8 flaw involving cPanel’s EmailTrack feature.
Fixes exist for the CalDAV, CardDAV and WP Toolkit issues. cPanel and WHM users should run the standard upgrade command as root, or go through WHM’s upgrade menu, while WP Toolkit requires a separate manual update since it installs as its own package. Neither advisory offers a temporary workaround for servers that can’t update immediately, and cPanel hasn’t said whether automatic updates will pick up the WP Toolkit fix on their own.
None of the three flaws currently appear in CISA’s Known Exploited Vulnerabilities catalog, and cPanel’s advisories don’t mention any confirmed attacks. Given how frequently this exact escalation pattern keeps surfacing lately, though, treating that absence as reassurance would be a mistake administrators shouldn’t make twice.
