CVE-2026-29202 — WebPros / cPanel

Description (CNA)

Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution on behalf of the already authenticated account's system user.

Affected (CNA)

Vendor / product	Versions
WebPros / cPanel	affected 11.136.0.0 before 11.136.0.9; affected 11.134.0.0 before 11.134.0.25; affected 11.132.0.0 before 11.132.0.31; affected 11.130.0.0 before 11.130.0.22; affected 11.126.0.0 before 11.126.0.58; affected 11.124.0.0 before 11.124.0.37; affected 11.118.0.0 before 11.118.0.66; affected 11.110.0.0 before 11.110.0.117; affected 11.102.0.0 before 11.102.0.41; affected 11.94.0.0 before 11.94.0.30; affected 11.86.0.0 before 11.86.0.43
WebPros / cPanel (CloudLinux 6, CentOS 6)	affected 11.110.0.0 before 11.110.0.116
WebPros / WP Squared	affected 11.136.1.0 before 11.136.1.11

CWE

CWE-94

References

https://support.cpanel.net/hc/en-us/articles/40311426610327-Security-CVE-2026-29202-cPanel-WHM-WP2-Security-Update-May-08-2026

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.