WP Toolkit CVE-2026-47365

Argument injection vulnerability in WP Toolkit before version 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cross-tenant authorization and execute arbitrary wp-toolkit CLI commands as another account.

High 2026-09-08

cPanel Plesk

Default Update CMD

sudo /scripts/upcp --force

Situation

Impact

Any cPanel server (on any Operating System) that has WP Toolkit installed with wp-toolkit version lower than version 6.11.0.

Call to Action

Update wp-toolkit to the fixed version 6.11.0 via the following command run as the root user:

# /usr/local/cpanel/3rdparty/wp-toolkit/bin/wp-toolkit-installer.sh –version 6.11.0

If the above command doesn’t work, please try:

# bash <(curl https://wp-toolkit.plesk.com/cPanel/installer.sh || wget -O – https://wp-toolkit.plesk.com/cPanel/installer.sh) –version 6.11.0

How to Apply the Fix

Update the affected packages on your server to the patched release, then restart the relevant services.

sudo /scripts/upcp --force

References

Vendor Advisory

Security Advisories

Related Advisories

Security: Privilege Escalation via Phusion Passenger’s Watchdog API

2026-09-08

Security: GCVE-25-2026-07-45-3 Exim .forward Privilege Escalation

2026-09-08

Security: CVE-2026-58048 Database Privilege Escalation

2026-09-08

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System