This vulnerability in WebPros cPanel arises from improper validation of the 'plugin' parameter within the 'create_user' plugin, enabling an authenticated user to execute arbitrary Perl code on the system under their own user context. The flaw is classified as CWE-94 (Code Injection). It affects multiple cPanel versions ranging from 11.86.0.0 through 11.136.0.0. The CVSS v4.0 base score is 5.3, indicating medium severity, with an attack vector of network, low complexity, no privileges required beyond authenticated user, and no user interaction needed. The vulnerability is published but lacks an official remediation level or patch information.

An authenticated user with access to the vulnerable 'create_user' plugin can execute arbitrary Perl code on the system with their own user privileges. This could lead to unauthorized actions within the scope of that user account. There is no indication of privilege escalation beyond the authenticated user's rights or of system-wide compromise. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the 'create_user' plugin to trusted users only and monitor for suspicious activity related to plugin usage. Avoid exposing cPanel interfaces to untrusted networks to reduce risk.