CVE-2026-47365

Executive Summary

CVE-2026-47365 is a critical argument injection vulnerability in the WordPress Toolkit component (before version 6.11.0) shipped with cPanel & WHM. This flaw allows a remote authenticated user to bypass cross-tenant authorization controls and execute arbitrary wp-toolkit CLI commands as another account, potentially leading to full compromise of managed WordPress installations and server-level privilege escalation. The vulnerability carries a CVSS score of 9.9 and affects all cPanel & WHM servers running WordPress Toolkit versions prior to 6.11.0.

Technical Analysis

The vulnerability resides in the WordPress Toolkit component integrated into cPanel & WHM control panel software. WordPress Toolkit is a management interface that allows administrators and resellers to manage multiple WordPress installations across different tenant accounts from a centralized console. The component bridges the cPanel/WHM web interface to a command-line utility called wp-toolkit, which performs the underlying operations (installations, updates, plugin management, backups, etc.).

The underlying weakness is an argument injection vulnerability, classified as CWE-88. Argument injection occurs when user-supplied input is passed unvalidated to a command-line function, allowing an attacker to inject additional command-line arguments beyond those intended by the application's logic. In this specific case, WordPress Toolkit fails to properly sanitize user-controlled parameters before they are appended to an invocation of the wp-toolkit CLI utility.

The critical security implication is that this argument injection bypasses the cross-tenant authorization model. In a multi-tenant cPanel environment, each account (tenant) should be constrained to operate exclusively on its own WordPress installations. The authorization layer that enforces this isolation is implemented in the web-facing component; however, the injected CLI arguments can trick the underlying wp-toolkit utility into operating on different accounts' data or executing commands with escalated privileges. This is an authorization bypass achieved through the command-line interface rather than directly through the web API.

The attack surface is exposed through any web-accessible WordPress Toolkit management function that accepts user input propagated to the CLI. Since the vulnerability is exploitable by remote authenticated users, it requires a valid account on the cPanel server — potentially a low-privilege reseller or even a standard hosting account — but not administrative access. The severity is elevated because WordPress Toolkit commonly runs with elevated privileges to manage files and databases across accounts, meaning successful exploitation can result in operations performed outside the user's tenant boundaries.

WordPress Toolkit versions prior to 6.11.0 are affected. The flaw is classified under CWE-88 (Argument Injection), indicating the root cause is the failure to sanitize arguments before they reach the CLI execution layer. The exact affected version range for cPanel & WHM builds is not specified in the NVD data, but any deployment using WordPress Toolkit below 6.11.0 is vulnerable.

Exploitation Scenarios

The following is a step-by-step attack chain based on the vulnerability class and the affected component:

1. Reconnaissance and Target Identification:

• An attacker identifies a cPanel & WHM server as a target by scanning for port 2083 (cPanel web interface) or port 2087 (WHM interface) using Shodan dorks such as http.title:"cPanel" port:2083 or by scanning for SSL certificates containing "cPanel".
• The attacker determines the WordPress Toolkit version by inspecting the version string in the cPanel interface footer or by probing known WordPress Toolkit endpoints and observing behavior differences.
• The attacker obtains valid credentials for a low-privileged account (e.g., a standard cPanel hosting account) through phishing, credential stuffing, or purchasing credentials on underground markets. Notably, the vulnerability requires only "remote authenticated" access — not administrative credentials.

2. Vector Weaponization:

The attacker crafts HTTP requests to WordPress Toolkit's web management interface that trigger the affected functionality. The malicious input leverages argument injection syntax. In command-line argument injection, an attacker typically:

• Appends a -- separator followed by legitimate CLI options that alter the scope of the operation.
• Uses the fact that many CLI tools interpret subsequent arguments as options that override prior settings.

For example, if the web application constructs a command such as:

wp-toolkit --user <authenticated_user> --domain <parameter>

The attacker would submit a crafted <parameter> containing injected arguments:

--domain victim.com --set-user target_account

When the argument injection is concatenated into the CLI invocation, the wp-toolkit utility interprets the injected parameters and operates on the target_account instead of the intended tenant. The attacker can inject CLI flags that specify a different account context, path, or operation scope.

3. Payload Execution: Once the attacker identifies which parameter is propagated to the CLI unvalidated, they iterate through the WordPress Toolkit web functions to find one that:

• Accepts a free-form string parameter (e.g., domain name, path, or installation ID).
• Reflects that parameter into the CLI command without quoting or validation.

A typical exploitation request could target a "backup" or "repair" function where a domain or path parameter is passed to the CLI. The payload would be:

POST /wordpress-toolkit/backup.php HTTP/1.1
Host: target-cpanel-server.com
Cookie: [valid session cookie]

domain=victim.com&type=full&--exec=id

The server-side code would construct a command like wp-toolkit --domain victim.com --exec=id — and the injected --exec=id argument causes the CLI tool to execute the system id command.

4. Post-Exploitation Impact:

• Data Exfiltration: The attacker executes commands to read configuration files containing database credentials for other tenants.
• Lateral Movement: The attacker creates WordPress admin users in other tenants' installations, defaces websites, or installs backdoors (malicious plugins/themes).
• Privilege Escalation: If the wp-toolkit process runs with elevated privileges (e.g., as the server's root user or with broad file-system access), the attacker may execute system commands that lead to full server compromise, including reading /etc/shadow or installing a rootkit.
• Persistence: The attacker plants a persistent webshell in a compromised account's web directory.

Impact Assessment

The CVSS score of 9.9 places this vulnerability at the critical severity level, reflecting the following subscores derived from the vector string:

• Attack Vector: Network — exploitable remotely.
• Attack Complexity: Low — no special conditions required.
• Privileges Required: Low — any authenticated cPanel account suffices.
• User Interaction: None — no victim interaction needed.
• Scope: Changed — the impact extends beyond the vulnerable component to the host operating system and other tenants.
• Confidentiality, Integrity, Availability Impact: High in all three dimensions.

Business Impact:

• Multi-Tenant Data Breach: Shared hosting providers risk cross-tenant data exposure, violating isolation guarantees and potentially violating regulatory requirements (GDPR, PCI-DSS).
• Server Compromise: Attackers may escalate from a single hosting account to a full server root compromise.
• Reputation Damage: Breaches of shared hosting infrastructure erode customer trust and may lead to customer churn.
• Operational Disruption: Administrators may need to rebuild servers, restore compromised accounts, and notify affected customers.

Affected Systems:

• All cPanel & WHM installations with WordPress Toolkit prior to 6.11.0.
• Managed WordPress hosting providers using cPanel & WHM as their control panel.
• Any server using WordPress Toolkit's CLI integration with automated provisioning scripts.

Blast Radius: The Scope=Changed factor indicates the vulnerability can affect resources beyond the application's security boundary — namely, the host operating system and all other tenant accounts on the server. An attacker can access files and databases belonging to unrelated customers.

Detection Guidance

Sigma Rule

title: CVE-2026-47365 - WordPress Toolkit Argument Injection
id: c4f1e2d3-9b7a-4e5d-8f2a-1c3b5a7e9d21
status: experimental
description: Detects exploitation of argument injection in WordPress Toolkit (cPanel & WHM) allowing CLI command injection
logsource:
    category: webserver
    product: apache
detection:
    selection_cpanel:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'wp-toolkit'
            - 'wordpress-toolkit'
    selection_payload:
        cs-uri-query|contains:
            - '--exec='
            - '--system='
            - '--call='
            - '--eval='
            - '%2D%2Dexec%3D'
            - '%2D%2Dsystem%3D'
            - ';id'
            - '|id'
    condition: selection_cpanel and selection_payload
level: high
falsepositives:
    - Legitimate WordPress Toolkit operations using dash-prefixed parameters
tags:
    - attack.t1190
    - cve.2026-47365
    - cwe.88

YARA Rule

rule CVE_2026_47365_WordPress_Toolkit_Arg_Injection
{
    meta:
        author = "Valters IT Security"
        description = "Detects argument injection payloads targeting WordPress Toolkit in cPanel & WHM"
        date = "2025-05-15"
        cve = "CVE-2026-47365"
        cwe = "CWE-88"
        severity = "critical"
    strings:
        $a1 = "--exec=" ascii wide
        $a2 = "--system=" ascii wide
        $a3 = "--call=" ascii wide
        $a4 = "--eval=" ascii wide
        $a5 = "--run=" ascii wide
        $b1 = "wp-toolkit" ascii wide noscii
        $b2 = "wordpress-toolkit" ascii wide noscii
        $b3 = "wp_toolkit" ascii wide noscii
        $c1 = "&--" ascii wide
        $c2 = "%2D%2D" ascii wide
    condition:
        (any of ($a*) and any of ($b*)) or
        (any of ($c*) and any of ($b*) and #a* > 0)
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2026-47365 - WordPress Toolkit Argument Injection Attempt";
    flow:established,to_server;
    http.method; content:"POST";
    http.uri; content:"wordpress-toolkit";
    http.uri; content:"--exec="; nocase;
    sid:2026473650;
    rev:1;
    metadata:attack_target Web_Server, deployment Perimeter, signature_severity Critical, created_at 2025_05_15, cve CVE-2026-47365;
    reference:cve,2026-47365;
)

Elastic Detection

sequence by destination.ip, user.name with maxspan=5m
  [network where event.action == "connection" and destination.port in (2083, 2087, 443, 8443)]
  [http where event.module == "apache" and
     http.request.method == "POST" and
     url.path contains ("wp-toolkit", "wordpress-toolkit") and
     (url.query contains "--exec=" or
      url.query contains "--system=" or
      url.query contains "--call=" or
      url.query contains ";id" or
      url.query contains "|id")]

Elastic EQL Alternative:

any where process.name == "wp-toolkit" and
    process.command_line regex~ ".*--(exec|system|call|eval)=.*"

Splunk SPL Query

index=web sourcetype=access_combined status=200
    uri_path IN ("/wp-toolkit/*", "/wordpress-toolkit/*", "/cgi/wp-toolkit*")
    | where match(_raw, "(?i)(--exec=|--system=|--call=|--eval=|;id|\|id)")
    | table _time, src_ip, user, uri_path, uri_query, status, http_user_agent
    | eval exploitation_indicator = if(match(uri_query, "(?i)(--exec=|--system=|--call=|--eval=)"), "CRITICAL", "SUSPICIOUS")
    | sort - _time

Wazuh OSSEC Rule

<group name="wp_toolkit_argument_injection,">
  <rule id="100265" level="14">
    <decoded_as>json</decoded_as>
    <field name="url">\.(wp-toolkit|wordpress-toolkit)</field>
    <regex>(\-\-(exec|system|call|eval|run)=|;id|\|id)</regex>
    <description>CVE-2026-47365 - WordPress Toolkit argument injection exploit attempt detected</description>
    <mitre><id>T1190</id></mitre>
    <group>attack_execution,</group>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

Despite the NVD description stating the flaw exists "before 6.11.0" (implying version 6.11.0 contains the fix), no patch has been observed in any tracked source as of this report. This discrepancy indicates either the fix has not yet been publicly released through standard channels or the versioning information has not been fully propagated. Administrators should verify with their cPanel license provider and actively monitor release announcements.

1. Immediate Mitigations (while awaiting patch):

• Restrict WordPress Toolkit administrative access to trusted IP addresses only via firewall rules on ports 2083, 2087, and 8443.
• Disable WordPress Toolkit features that are not essential to business operations by navigating to WHM → WordPress Toolkit and disabling the management interface if not critical.
• Enforce multi-factor authentication (MFA) on all cPanel/WHM accounts, especially reseller accounts that have broader access.
• Audit existing accounts for shared or weak passwords; force password resets for accounts that may have been compromised.
• Implement additional web application firewall (WAF) rules (ModSecurity) that block requests containing --exec=, --system=, or other suspicious double-dash CLI argument patterns in WordPress Toolkit URLs.

2. Patch/Upgrade Steps:

• Update WordPress Toolkit to version 6.11.0 or later as soon as it becomes available through the cPanel update manager.
• In WHM, navigate to: Home → Software → Update cPanel & WHM to check for available updates.
• Alternatively, run the command line update: yum update cpanel-wordpress-toolkit or the equivalent for your operating system's package manager.
• After updating, verify the installed version: wp-toolkit --version or via WHM interface under WordPress Toolkit → Settings.

3. Long-Term Hardening:

• Subscribe to cPanel security announcements to receive timely notifications of patches.
• Review cPanel hardening documentation and implement recommended security configurations, including restricting access to sensitive ports.
• Implement Security-Enhanced Linux (SELinux) policies or AppArmor profiles that constrain the wp-toolkit process's file system and process execution permissions.
• Enable cPanel's built-in mod_security rules and keep them updated.
• Conduct periodic security audits of all cPanel/WHM server configurations to identify misconfigurations.
• Monitor server logs for anomaly detection using the detection rules above.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-47365
2. CWE-88 Argument Injection: https://cwe.mitre.org/data/definitions/88.html
3. cPanel Security Announcements: https://security.cpanel.net/
4. WordPress Toolkit Documentation: https://docs.cpanel.net/whm/wordpress-toolkit/wordpress-toolkit/
5. MITRE ATT&CK — T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/

Threat Actor Activity: No known threat actor campaigns or exploit-in-the-wild evidence have been reported for this vulnerability at the time of writing. The EPSS score of 0.00409 places this CVE at the 33.6th percentile of exploited vulnerabilities, indicating a low but non-zero likelihood of active exploitation. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog (CISA KEV status: NO).