This vulnerability in WebPros cPanel arises from improper input validation (CWE-20) of the 'plugin' parameter in the 'create_user' plugin. An attacker who is already authenticated can exploit this flaw to execute arbitrary Perl code under the context of the authenticated system user. The issue affects multiple versions of cPanel, including 11.86.0.0 through 11.136.0.0. No CVSS score or official remediation level has been provided, and no patch links are available. The vulnerability was published on 2026-05-08 and assigned by HackerOne.

Successful exploitation allows arbitrary Perl code execution with the privileges of the authenticated system user, potentially leading to unauthorized actions or system compromise within the scope of that user's permissions. Since exploitation requires authentication, the impact is limited to users who already have access to the system. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users and monitor for unusual activity related to the 'create_user' plugin. Avoid using affected versions if possible and follow vendor updates closely.