CVE-2026-47365 PUBLISHED

Assigner: hackerone
Reserved: 19.05.2026 Published: 12.06.2026 Updated: 12.06.2026

Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cross-tenant authorization and execute arbitrary wp-toolkit CLI commands as another account.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 9.9

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	WebPros
Product	WordPress-Toolkit
Versions	Default: unaffected affected from 0 to 6.11.0 (excl.)

Credits

Georgii Shutiaev reporter

References

https://support.cpanel.net/hc/en-us/articles/41004584983703-WP-Toolkit-CVE-2026-47365

Problem Types

CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') CWE