Vulnerabilities / CVE-2026-47365

CVE-2026-47365

Published 2026-06-12 · Awaiting Analysis

CVE-2026-47365

9.9 CRITICAL
CVSS 3.1 · CNA · hackerone.com

0.4%
chance of exploitation in the next 30 days (EPSS; higher than 35% of CVEs)

Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cross-tenant authorization and execute arbitrary wp-toolkit CLI commands as another account.

Scores

9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HCNA · hackerone.com

Affected products

WebPros WordPress-Toolkit: < 6.11.0

Weakness: CWE-88

1 references (advisories, patches, write-ups)

https://support.cpanel.net/hc/en-us/articles/41004584983703-WP-Toolkit-CVE-2026-47365

Sources: NVD, CVE.org, FIRST EPSS. Missing ones did not answer or have no record yet.

Look up another CVE Check your dependencies Scan a website