WP Toolkit CVE-2026-47365

Situation

Argument injection vulnerability in WP Toolkit before version 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cross-tenant authorization and execute arbitrary wp-toolkit CLI commands as another account.

Impact

Any cPanel server (on any Operating System) that has WP Toolkit installed with wp-toolkit version lower than version 6.11.0.

Call to Action

Update wp-toolkit to the fixed version 6.11.0 via the following command run as the root user:

# /usr/local/cpanel/3rdparty/wp-toolkit/bin/wp-toolkit-installer.sh –version 6.11.0

If the above command doesn’t work, please try:

# bash <(curl https://wp-toolkit.plesk.com/cPanel/installer.sh || wget -O – https://wp-toolkit.plesk.com/cPanel/installer.sh) –version 6.11.0

sudo /scripts/upcp --force