A flaw in the create_user plugin allows an authenticated user to supply an unvalidated value for the plugin parameter, causing the plugin to execute arbitrary Perl code as the system user of the cPanel account. The weakness is an input validation defect combined with a code execution vulnerability (CWE‑94), which could compromise confidentiality, integrity, and availability of the entire host. The description emphasizes that the parameter is not checked before execution and that the attacker can control the payload.

The vulnerability affects WebPros cPanel deployments, including installations on CentOS 6, CloudLinux 6, and the WP Squared component that interfaces with the create_user plugin. Versions that have not applied the missing input validation fix are vulnerable; vendor documentation does not list specific affected cPanel releases.

Exploitation requires a valid authenticated cPanel session that can access the create_user interface. The EPSS score below 1% indicates a low probability of exploitation in the wild, and the CVSS score of 5.3 reflects moderate severity. The vulnerability is not listed in CISA’s KEV catalog, but the potential impact on a compromised account warrants timely patching. Based on the description, it is inferred that the attack vector is an authenticated user session within cPanel, requiring prior compromise of login credentials, and the attack path is straightforward once those credentials are obtained, as the plugin processes the parameter without validation and executes it directly.