CVE-2026-93698: insufficient validation in cPanel and WP Squared Multilang adminbin
Shared hosting control panels are a concentration of privilege. CVE-2026-93698, rated 9.9, sits in exactly that layer: the Multilang adminbin handler in cPanel and WP Squared accepts input it should reject, and the outcome is arbitrary system command execution.
The component and the flaw
adminbin is the privileged helper that the cPanel and WHM interfaces call when a user action needs to run as root. Multilang is one of the cPanel features that routes through it. The disclosure describes insufficient validation on that path, which lets an attacker execute arbitrary system commands.
The technical detail that matters for defenders is the trust boundary. A control panel user is not a system administrator, but the helper they can reach is. When validation on the helper's inputs is incomplete, the gap between "hosting account" and "root on the server" closes.
WebPros has published the affected product list as cPanel and WP Squared. Administrators should check the vendor's advisory for the fixed build that applies to their release channel.
Why shared hosting makes this urgent
On a dedicated server, a control panel RCE is bad. On a shared host, it is a multi-tenant incident.
One exploited account on a shared platform can reach every other account on the same machine: website files, mail stores, databases, and the credentials that tenants stored because the panel told them it was safe. The reputation damage lands on the host, and the host's customers find out last.
There is a second effect that is easy to miss. The control panel itself holds the hosting business's own administrative access, including billing integrations and the ability to create new accounts. An attacker with command execution on the panel host can add a tenant, and that tenant can outlive the incident response.
Practical remediation
Apply the vendor update on the panel host first, then on every other host in the fleet. A patched head node in front of unpatched workers is not a fix.
Audit the accounts that can reach the Multilang path. Hosting providers frequently carry admin-level panel accounts for support staff that were created years ago and never reviewed. Each one is a separate way to reach the vulnerable handler before the patch lands.
Review the panel's own logs for unexpected calls to adminbin helpers. cPanel writes to /usr/local/cpanel/logs/access_log, and unusual parameter combinations to adminbin endpoints are worth an alert even after patching, because the log is the only record of an attempt.
Finally, check for persistence. Command execution as root on a hosting node usually ends with a cron entry, an added SSH key, or a modified web template. Those are the artifacts to hunt for if the panel was exposed while unpatched.
Top comments (0)