Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-29202

Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution on behalf of the already authenticated account's system use

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
hackerone

Description

Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution on behalf of the already authenticated account's system user.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WebPros cPanel

Default version status: unaffected

  • 11.136.0.0 to < 11.136.0.9affected
  • 11.134.0.0 to < 11.134.0.25affected
  • 11.132.0.0 to < 11.132.0.31affected
  • 11.130.0.0 to < 11.130.0.22affected
  • 11.126.0.0 to < 11.126.0.58affected
  • 11.124.0.0 to < 11.124.0.37affected
  • 11.118.0.0 to < 11.118.0.66affected
  • 11.110.0.0 to < 11.110.0.117affected
  • 11.102.0.0 to < 11.102.0.41affected
  • 11.94.0.0 to < 11.94.0.30affected
  • 11.86.0.0 to < 11.86.0.43affected

WebPros cPanel (CloudLinux 6, CentOS 6)

Default version status: unaffected

  • 11.110.0.0 to < 11.110.0.116affected

WebPros WP Squared

Default version status: unaffected

  • 11.136.1.0 to < 11.136.1.11affected

References