Brief Summary: CVE-2026-47365 — Argument Injection in cPanel WP Toolkit Breaks Tenant Isolation

Introduction

A single authenticated cPanel account on a shared hosting server can now compromise every other tenant's WordPress installations, because an argument injection flaw in WP Toolkit breaks cross-tenant isolation. CVE-2026-47365, which HackerOne scored at CVSS 9.9, lets any remote authenticated cPanel user inject arguments into the wp-toolkit CLI and run commands as a different account on the same server.

WP Toolkit is a cPanel and Plesk plugin for managing WordPress installations from one place, including mass operations on sites, plugins, and themes. It ships as a third-party component within cPanel & WHM and is widely deployed across the shared hosting industry. According to 6sense, cPanel holds an estimated 94.10% share of the web hosting control panel market. WP Toolkit runs with elevated privileges so it can manage WordPress instances across tenant boundaries, which gives a flaw in its argument handling outsized consequences for multi-tenant environments.

Technical Information

Root Cause: CWE-88 Argument Injection

CVE-2026-47365 is classified under CWE-88: Improper Neutralization of Argument Delimiters in a Command. This weakness occurs when software builds a command string to execute but does not properly delimit the intended arguments, options, or switches inside it.

CWE-88 is distinct from the more common CWE-78 (OS Command Injection). Argument injection needs no shell metacharacters such as semicolons, pipes, or backticks. It uses argument-separating characters like whitespace or dashes to inject unintended options or switches that change what the command does. The MITRE CWE entry gives a canonical example. A Perl routine validates filenames against a pattern like /^[\w\-]+$/ and passes them to /bin/ls -l $fname. An attacker can inject an argument such as -l /etc/passwd to override the intended behavior without using any shell metacharacters. The same principle applies to CVE-2026-47365.

The vulnerability was in how WP Toolkit handled arguments passed to its internal CLI layer. Before version 6.11.0, WP Toolkit did not properly neutralize argument delimiters in user-controlled input before using that input to build wp-toolkit CLI commands. A crafted request could therefore inject extra arguments or switches into the CLI invocation, and those injected arguments could make the command run in the context of a different cPanel tenant account.

CVSS Breakdown

HackerOne, the CNA for this CVE, assigned this CVSS 3.1 vector string:

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9 CRITICAL

The most important part of the vector is the Changed scope (S:C). It reflects that exploitation crosses the tenant authorization boundary and affects resources outside the attacker's own security scope. The attack works over the network, needs only low privileges (any authenticated cPanel account), has low attack complexity, and requires no user interaction.

NVD lists its CVSS 4.0 assessment as "N/A" with the note "NVD assessment not yet provided," so the official NVD severity may change.

Attack Flow

Exploitation takes three steps:

1. The attacker logs in to cPanel with any valid account credentials on the target server. That is the only prerequisite, and in a shared hosting environment every paying customer has such credentials.

2. The attacker crafts input containing additional argument delimiters or switches and submits it through the WP Toolkit interface. Because the toolkit does not properly sanitize these delimiters before building the CLI command, the injected arguments become part of the executed command.

3. The injected arguments make the wp-toolkit CLI command run in the context of a different cPanel tenant account. This bypasses the authorization boundary that should stop one account from acting on another account's WordPress installations.

Impact

A successful exploit lets an attacker perform any operation the wp-toolkit CLI supports against another tenant's WordPress sites. That could include:

• Installing malicious plugins or themes on the victim's WordPress sites
• Modifying site configurations (including admin credentials)
• Extracting database credentials stored in wp-config.php
• Achieving arbitrary code execution within the victim's WordPress environment

On shared hosting, where dozens or hundreds of accounts may sit on a single server, one compromised or malicious tenant could cascade into a server-wide breach.

Chaining Potential with CVE-2026-41940

One especially concerning scenario chains this vulnerability with CVE-2026-41940, the April 2026 cPanel authentication bypass (CVSS 9.8) that was actively exploited as a zero-day for months. An attacker who first uses CVE-2026-41940 to get unauthenticated access to a cPanel account could then use CVE-2026-47365 to escalate across tenant boundaries. On shared hosting servers where both vulnerabilities remain unpatched, that combination would let unauthenticated remote attackers compromise WordPress sites across tenants. This chain has not been observed in the wild, but it is a realistic threat model, given the documented exploitation of CVE-2026-41940 and the public proof-of-concept code for it.

Patch Information

WP Toolkit version 6.11.0 contains the fix. It removes the argument injection flaw by properly sanitizing and validating argument delimiters before they reach the CLI execution path, so a user's commands stay scoped to their own tenant. The previous release, WP Toolkit 6.10.1 (released April 15, 2026), is still vulnerable.

WP Toolkit ships as a third-party component within cPanel & WHM and follows its own versioning and release cycle, independent of the core cPanel version. Upgrading to 6.11.0 is the only remediation path. There is no separate hotfix or configuration workaround.

cPanel's official advisory gives two ways to apply the update. The primary method, run as root, is:

/usr/local/cpanel/3rdparty/wp-toolkit/bin/wp-toolkit-installer.sh --version 6.11.0

If the local installer script is unavailable or does not work, the alternative method fetches the installer directly from the upstream distribution:

bash <(curl https://wp-toolkit.plesk.com/cPanel/installer.sh || wget -O - https://wp-toolkit.plesk.com/cPanel/installer.sh) --version 6.11.0

Community reports on Reddit say some administrators saw long execution times when running the primary upgrade command on servers with WP Toolkit 6.10.1 installed. On servers with large WordPress inventories, administrators should plan for a possibly longer patching window.

After applying the patch, confirm that the installed WP Toolkit version is 6.11.0 or higher. If patching has to wait, consider temporarily disabling the WP Toolkit plugin to reduce the attack surface. cPanel has not officially endorsed this approach.

Affected Systems and Versions

The vulnerability affects any cPanel server with WP Toolkit installed at a version lower than 6.11.0, on any supported operating system (CentOS, AlmaLinux, Ubuntu, and others).

Vendor Security History

2026 has been a hard year for cPanel security, with several critical vulnerabilities disclosed in quick succession:

CVE-2026-41940 was actively exploited as a zero-day for months before cPanel disclosed it on April 28, 2026. CyberScoop reported widespread exploitation, and Picus Security documented more than 1.5 million affected cPanel instances. Threat activity surged after disclosure, including brute force attacks and ransomware deployment, and a public proof-of-concept was available.

CVE-2026-47365 was reported through cPanel's HackerOne bug bounty program, which indicates it came through coordinated disclosure rather than being found in the wild. That is a good sign for cPanel's engagement with the security research community. Still, the frequency and severity of recent disclosures suggest underlying code quality problems that deserve attention.

cPanel runs a Security Bounty Program that rewards researchers who follow responsible disclosure principles.

References

• cPanel Official Advisory: WP Toolkit CVE-2026-47365
• NVD Entry: CVE-2026-47365
• cPanel Release Notes
• CWE-88: Improper Neutralization of Argument Delimiters in a Command
• cPanel Security Advisory: CVE-2026-41940
• Cybersecurity Dive: Critical vulnerability in cPanel leads to widespread exploitation
• SecurityWeek: Critical cPanel & WHM Vulnerability Exploited as Zero-Day for Months
• Rapid7: CVE-2026-41940 cPanel & WHM Authentication Bypass
• Picus Security: CVE-2026-41940 Explained
• CyberScoop: cPanel's authentication bypass bug is being exploited in the wild
• cPanel Documentation: Install WP Toolkit
• 6sense: cPanel Market Share in Web Hosting Control Panel
• cPanel HackerOne Response Policy
• cPanel Security Bounty Program
• Reddit Discussion: WP Toolkit CVE-2026-47365
• CISA Known Exploited Vulnerabilities Catalog
• cPanel Wikipedia Entry