Description
Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Webpros cPanel
Default version status: unaffected
0 to < 11.138.0.11affected0 to < 11.136.0.45affected0 to < 11.134.0.61affected0 to < 11.110.0.148affected
Webpros WP Squared
Default version status: unaffected
0 to < 11.138.1.13affected
References
- https://hackerone.com/reports/4054291 ↗
- https://support.cpanel.net/hc/en-us/articles/43845931719447-Security-CVE-2026-93698-Vulnerability-in-Multilang-Adminbin-September-29-2026 ↗
- https://docs.cpanel.net/changelogs/138-change-log/#138011 ↗
- https://docs.cpanel.net/changelogs/136-change-log/#136045 ↗
- https://docs.cpanel.net/changelogs/134-change-log/#134061 ↗
- https://docs.cpanel.net/changelogs/110-change-log/#1100148 ↗
- https://docs.wpsquared.com/changelogs/versions/changelog/#138113 ↗