New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control

Critical vulnerabilities in cPanel's CalDAV/CardDAV service and WP Toolkit plugin allowed any authenticated account holder to execute code with root privileges, effectively handing full server control to an unprivileged user. This is a severe privilege escalation failure — shared hosting environments are particularly dangerous because many untrusted users share the same underlying system, meaning one compromised or malicious account can compromise every tenant on the server. The cross-account database modification flaw further violates the principle of least privilege and tenant isolation. These flaws matter because hosting providers running unpatched cPanel installations expose not only their own infrastructure but every customer and website hosted on those servers. cPanel has released patches, making rapid deployment the most critical remediation step.