CVE-2026-47365
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk22th percentile — higher than 22% of all known CVEs
Summary
CVE-2026-47365 is an argument injection vulnerability in WordPress Toolkit before version 6.11.0, as used in cPanel and WHM. It allows remote authenticated users to bypass cross-tenant authorization and execute arbitrary wp-toolkit CLI commands as another account.
Risk Assessment
This vulnerability may lead to unauthorized access to other users' accounts, posing a serious threat to the security of the organization's data and resources.
Recommendation
It is recommended to update WordPress Toolkit to version 6.11.0 or later to mitigate this vulnerability and review access security measures.
Original NVD description (English source)
Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cross-tenant authorization and execute arbitrary wp-toolkit CLI commands as another account.