New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control

A vulnerability in cPanel's CalDAV and CardDAV service allows users with a hosting account to execute code with root privileges, giving them complete control over the server. Additionally, a bug was found in the WP Toolkit plugin, which enables an account holder to modify databases belonging to other accounts. cPanel has issued updated versions to address both issues.