Executive Summary
A critical argument injection vulnerability (CVE-2026-47365) has been disclosed in WordPress Toolkit before version 6.11.0 as deployed within cPanel & WHM hosting control panels. With a CVSS score of 9.9 (Critical), this flaw allows remote authenticated users to bypass cross-tenant authorization controls and execute arbitrary wp-toolkit CLI commands in the context of another hosting account.
CVSS Score: 9.9 (Critical) Published: 2026-06-12 Status: Patch available — upgrade to WordPress Toolkit 6.11.0 or later
In shared hosting environments where cPanel & WHM is used, this vulnerability enables one tenant to issue privileged wp-toolkit CLI commands against another tenant's WordPress installations — a severe multi-tenancy security breach.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-47365 |
| CVSS Score | 9.9 (Critical) |
| Type | Argument Injection / Authorization Bypass |
| Attack Vector | Network |
| Authentication Required | Yes (low privilege) |
| Privileges Required | Low |
| User Interaction | None |
| Affected Software | WordPress Toolkit < 6.11.0 in cPanel & WHM |
| Published | 2026-06-12 |
Affected Products
| Product | Affected Version | Fixed Version |
|---|---|---|
| WordPress Toolkit (cPanel & WHM) | < 6.11.0 | 6.11.0 |
WordPress Toolkit is a cPanel & WHM plugin used by millions of shared and reseller hosting accounts to manage WordPress installations through an integrated control panel interface.
Technical Details
What Is Argument Injection?
Argument injection occurs when user-supplied input is passed to a command-line tool without proper sanitization, allowing an attacker to inject additional CLI flags or subcommands. Unlike command injection (which allows running arbitrary OS binaries), argument injection abuses the target application's own CLI by appending unexpected flags that alter command behavior.
How CVE-2026-47365 Works
In WordPress Toolkit's integration with cPanel & WHM, the plugin constructs wp-toolkit CLI invocations using account identifiers supplied over the network. The authorization check verifying that the calling user owns the target account can be bypassed by crafting an argument that references a different account's identifier.
1. Authenticated attacker (Account A) sends a crafted request to WordPress Toolkit API
2. Request includes injected arguments referencing Account B's wp-toolkit context
3. WordPress Toolkit constructs wp-toolkit CLI call without sufficient cross-tenant validation
4. wp-toolkit CLI executes with Account B's context
5. Attacker can enumerate, modify, or take over Account B's WordPress installationsWhy CVSS 9.9?
The near-maximum score reflects:
- Low privilege required — any authenticated hosting account can exploit this
- No user interaction — fully remote, no victim action needed
- Cross-tenant impact — complete confidentiality, integrity, and availability compromise of affected WordPress installations across tenant boundaries
Impact Assessment
| Impact Area | Description |
|---|---|
| Cross-Tenant Data Access | Read configuration, credentials, and content from other tenants' WordPress installs |
| Account Takeover | Install malicious plugins, reset admin passwords, or backdoor other tenants' sites |
| Hosting Provider Risk | Shared hosting providers face liability for multi-tenant isolation failures |
| Mass Exploitation | Low skill bar for exploitation by any authenticated user on a shared server |
| Reputational Damage | Tenant data exposure can impact hosting provider reputation |
Recommendations
Immediate Actions
- Update WordPress Toolkit to version 6.11.0 or later via the cPanel & WHM plugin manager
- Audit access logs for unusual cross-account
wp-toolkitinvocations - Verify tenant isolation is enforced at the server level (filesystem permissions, PHP-FPM pools)
For Hosting Providers
- Apply the update during the next maintenance window (or immediately for public-facing servers)
- Review API gateway logs for requests with cross-account argument patterns
- Notify affected tenants if suspicious cross-tenant activity is detected
- Consider temporary rate-limiting or WAF rules for the WordPress Toolkit API endpointDetection Signals
| Indicator | Description |
|---|---|
| wp-toolkit CLI calls referencing unexpected account IDs | Potential exploitation |
| Unusual WordPress admin password changes across tenants | Post-exploitation activity |
| New plugin installations on accounts not owned by the calling user | Authorization bypass exploitation |
| Elevated file system access across user home directories | Successful tenant escape |
Post-Remediation Checklist
- Confirm WordPress Toolkit is updated to 6.11.0+ on all cPanel & WHM servers
- Review web server access logs for unusual API patterns before the patch date
- Check all WordPress installations for unauthorized admin accounts or plugins
- Verify PHP-FPM / suPHP isolation is correctly configured per tenant
- Update security documentation and notify tenants as appropriate per your breach notification policy