Executive Summary

CVE-2026-47365 is an argument injection vulnerability in WP Toolkit versions before 6.11.0 when used in cPanel & WHM environments.

This flaw allows remote authenticated users to bypass cross-tenant authorization controls and execute arbitrary WP Toolkit CLI commands with the privileges of another account.

Essentially, an attacker who is authenticated can perform actions as if they were another user, potentially compromising other tenants on the same server.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts on affected systems.

• Remote authenticated attackers can bypass authorization boundaries between tenants.
• Attackers can execute arbitrary WP Toolkit CLI commands as another user, potentially leading to unauthorized access or control over other accounts.
• This can result in data compromise, service disruption, or further exploitation within a multi-tenant cPanel server environment.

To mitigate these risks, it is critical to update WP Toolkit to version 6.11.0 or later.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the risk of CVE-2026-47365, administrators must update WP Toolkit to version 6.11.0 or later.

The recommended update command for root users is:

• # /usr/local/cpanel/3rdparty/wp-toolkit/bin/wp-toolkit-installer.sh --version 6.11.0

If the above command fails, an alternative method is to run:

• # bash <(curl https://wp-toolkit.plesk.com/cPanel/installer.sh || wget -O - https://wp-toolkit.plesk.com/cPanel/installer.sh ) --version 6.11.0

Useful 0 Not Useful 0