An authenticated system user can supply an arbitrary value for the `plugin` parameter in the cPanel create_user plugin, which the plugin does not properly validate. This flaw allows execution of arbitrary Perl code in the context of the cPanel account, potentially compromising the entire system. The weakness is a classic input validation defect identified by CWE‑20, and it directly impacts the confidentiality, integrity, and availability of the affected host.

The vulnerability is found in WebPros cPanel, including installations on CentOS 6 and CloudLinux 6. The WP Squared component, which integrates with the create_user plugin, is also affected. The specific affected products are cPanel versions that have not applied the missing input validation fix; exact version details are not supplied.

The flaw requires the attacker to have a valid authenticated cPanel session with access to the create_user interface. No exploitation details are disclosed beyond the parameter injection, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. With no EPSS score available, the likelihood of real‑world exploitation is uncertain, but the impact of arbitrary code execution poses a high threat when combined with the CVSS score of 8.8, indicating high severity, if the advisory is accepted.