Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-93698

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.

Published
Last modified
Status
published
Known exploitation
Not listed in CISA KEV
Fix
Fixed in 11.138.0.11, 11.136.0.45, 11.134.0.61, 11.110.0.148, 11.138.1.13
Public exploit
None on Exploit-DB
CISA SSVC
  • Exploitation: none
  • Automatable: no
  • Technical impact: total
?

Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).

SSVC documentation

Summary

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.

Affected versions

  • Webpros cPanel

    fixed in 11.138.0.11; fixed in 11.136.0.45; fixed in 11.134.0.61; fixed in 11.110.0.148

  • Webpros WP Squared

    fixed in 11.138.1.13

References 7

hackerone.com

support.cpanel.net

docs.cpanel.net

docs.wpsquared.com