CVE-2026-47365: WordPress Toolkit Auth Bypass Vulnerability

CVE-2026-47365 Overview

CVE-2026-47365 is an argument injection vulnerability [CWE-88] in WordPress Toolkit before version 6.11.0 as used in cPanel & WHM. The flaw allows remote authenticated users to bypass cross-tenant authorization and execute arbitrary wp-toolkit CLI commands under the context of another account. Exploitation requires only low-privileged authentication and no user interaction. Because cPanel & WHM is widely deployed in shared hosting environments, the vulnerability enables one tenant to operate against another tenant's WordPress installations. The issue was published on June 12, 2026 and tracks under CWE-88 (Improper Neutralization of Argument Delimiters).

Critical Impact
Authenticated tenants can execute wp-toolkit CLI commands as other cPanel accounts, breaking cross-tenant isolation and compromising hosted WordPress sites at scale.

Affected Products

cPanel & WHM with WordPress Toolkit before 6.11.0
Shared hosting environments using WordPress Toolkit for tenant WordPress management
Multi-tenant cPanel deployments with WP Toolkit enabled

Discovery Timeline

2026-06-12 - CVE-2026-47365 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-47365

Vulnerability Analysis

The vulnerability stems from improper neutralization of argument delimiters when WordPress Toolkit constructs wp-toolkit CLI invocations. An authenticated user can supply input containing additional command-line arguments that the toolkit forwards to the underlying CLI process. Because the arguments are not strictly validated or escaped, an attacker can introduce options that change which account context the CLI operates under. The result is a cross-tenant authorization bypass: an authenticated tenant directs wp-toolkit to perform actions against WordPress installations owned by other cPanel accounts. Successful exploitation yields high impact to confidentiality, integrity, and availability of co-tenant sites, including the ability to modify site files, change administrative credentials, install plugins, or disable installations. The scope is changed because the vulnerable component acts on resources outside the attacker's own security boundary.

Root Cause

The root cause is argument injection [CWE-88]. WordPress Toolkit passes user-controlled values into a CLI argument list without filtering values that begin with - or --, allowing additional flags to be interpreted by wp-toolkit. Account-scoping arguments can be overridden by attacker-supplied flags.

Attack Vector

An authenticated cPanel user submits a crafted request to a WP Toolkit endpoint that builds a wp-toolkit CLI command. The malicious payload injects an additional argument (for example, an account or owner flag) that redirects the command to operate on a different tenant. The attacker then issues toolkit operations against the targeted account's WordPress sites without holding credentials for that account.

The vulnerability is described in prose because no verified public proof-of-concept code is available. See the cPanel Security Advisory CVE-2026-47365 for vendor details.

Detection Methods for CVE-2026-47365

Indicators of Compromise

wp-toolkit CLI invocations where the executing cPanel user and the --owner or account-scoping argument do not match
Unexpected modifications to WordPress core files, wp-config.php, or administrative user records across multiple tenant home directories
New WordPress administrator accounts or plugin installations performed outside of the legitimate account owner's session activity

Detection Strategies

Audit WP Toolkit and wp-toolkit CLI logs for argument lists containing duplicated or unexpected -/-- flags supplied via web requests
Correlate authenticated cPanel session user identifiers with the target account of each WP Toolkit operation to surface cross-tenant activity
Review web server access logs for requests to WP Toolkit endpoints carrying input values that begin with - or contain shell argument delimiters

Monitoring Recommendations

Forward cPanel, WHM, and WP Toolkit logs to a centralized log platform and alert on cross-account operations
Monitor file integrity across all tenant public_html directories for unauthorized WordPress changes
Track creation of WordPress administrator accounts and plugin or theme installations performed via wp-toolkit

How to Mitigate CVE-2026-47365

Immediate Actions Required

Upgrade WordPress Toolkit to version 6.11.0 or later on all cPanel & WHM servers
Review WP Toolkit and wp-toolkit CLI logs for evidence of cross-tenant command execution prior to patching
Reset WordPress administrator credentials on tenant sites that show unexplained changes

Patch Information

Update WordPress Toolkit to version 6.11.0 or later. cPanel distributes WP Toolkit through standard cPanel update channels; ensure upcp or the cPanel update mechanism has completed and verify the installed version with /usr/local/cpanel/bin/wp-toolkit --version. Refer to the cPanel Security Advisory CVE-2026-47365 for full patch guidance.

Workarounds

Restrict access to WP Toolkit features to trusted cPanel users until the patch is deployed
Disable the WP Toolkit feature in WHM Feature Manager for accounts that do not require it
Increase logging verbosity on WP Toolkit and review activity until the upgrade completes

bash

# Verify installed WP Toolkit version and trigger cPanel update
/usr/local/cpanel/bin/wp-toolkit --version
/scripts/upcp --force