CVE-2026-47365: Argument injection vulnerability in WordPress Toolkit before 6

Synopsis

An argument injection vulnerability in WordPress Toolkit before version 6.11.0 (as used in cPanel and WHM) allows a remote authenticated user to inject malicious arguments into wp-toolkit CLI commands, bypassing the cross-tenant authorization that normally keeps hosting accounts isolated from one another. The attack is reachable over the network and requires only a low-privilege account, with no additional victim interaction needed. Successful exploitation gives the attacker full read, write, and denial-of-service capability over other tenants' WordPress installations. A patched-image rebuild at version 6.11.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; the attacker sends crafted requests to the WordPress Toolkit API or web interface from a remote location.

• AuthenticationRequired

  A low-privilege account on any tenant of the hosting environment is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  No action by another user or administrator is required to complete the attack.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, special memory layout, or environmental prerequisites are needed.

Blast Radius

• Reads all files, database contents, and credentials (including stored API keys and session tokens) belonging to any WordPress installation on the affected hosting server, across tenant boundaries.
• Writes or overwrites WordPress files, database rows, and configuration on targeted tenants, enabling content modification, backdoor implantation, or privilege escalation within those sites.
• Executes arbitrary wp-toolkit CLI commands as another account, meaning an attacker can install or remove plugins, create admin users, and alter site settings on tenants they do not own.
• Crashes or degrades WordPress sites on the same server by issuing destructive CLI commands, causing service disruption for all affected tenants.