PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-47365 cPanel CVE debrief

A argument injection vulnerability in WP Toolkit before version 6.11.0, as bundled with cPanel & WHM, allows remote authenticated users to bypass cross-tenant authorization boundaries and execute arbitrary wp-toolkit CLI commands under the context of another account. The flaw exists in how WP Toolkit handles command-line arguments, permitting injection that subverts intended tenant isolation on multi-user cPanel servers. cPanel published this advisory on June 5, 2026, with a subsequent modification on June 11, 2026. The vendor has released WP Toolkit version 6.11.0 to remediate the issue. Administrators must update via the provided installer script executed as root. No CISA KEV listing or known ransomware campaign use has been identified.

Vendor
cPanel
Product
WP Toolkit
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-05
Original CVE updated
2026-06-11
Advisory published
2026-06-05
Advisory updated
2026-06-11

Who should care

System administrators managing cPanel & WHM servers with WP Toolkit installed; hosting providers operating multi-tenant cPanel environments; security teams responsible for patch management and tenant isolation in shared hosting infrastructure.

Technical summary

WP Toolkit versions prior to 6.11.0 contain an argument injection flaw that enables authenticated cPanel users to craft malicious input passed to wp-toolkit CLI commands. This injected input bypasses cross-tenant authorization controls, allowing command execution as a different account on the same server. The vulnerability affects all cPanel server operating systems with the vulnerable WP Toolkit version installed. The fix in version 6.11.0 corrects input handling to prevent unauthorized argument injection and cross-tenant command execution.

Defensive priority

high

Recommended defensive actions

  • On all cPanel servers with WP Toolkit installed, verify the current wp-toolkit version. If below 6.11.0, schedule maintenance to run the vendor-provided installer script as root to update to version 6.11.0.
  • After updating, confirm the installed version by checking wp-toolkit output or package metadata.
  • Review server logs for anomalous wp-toolkit CLI execution patterns, particularly commands run outside expected user contexts, focusing on the period prior to patching.
  • Restrict cPanel account access where possible and enforce least-privilege principles to reduce exposure from authenticated attack vectors.
  • If indicators of unauthorized cross-tenant command execution are found, initiate incident response procedures to assess potential account compromise or data access.

Evidence notes

The vulnerability description, affected versions, and remediation command are derived from the official cPanel support article identified as a vendor_official_source with high confidence.

Official resources

cPanel disclosed this vulnerability via an official support article on June 5, 2026, and updated it on June 11, 2026.