Is CVE-2026-47365 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47365 being exploited in the wild.

How severe is CVE-2026-47365?

Critical severity, with a CVSS score of 9.9, published 12 June 2026.

Which products and versions are affected?

cPanel WordPress Toolkit before 6.11.0.

Is there a fix for CVE-2026-47365?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-47365 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-47365?

Check whether you run cPanel WordPress Toolkit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47365: cPanel WordPress Toolkit argument injection in CLI commands

CVE-2026-47365 · Severity: critical · CVSS 9.9 · Published 2026-06-12

A security vulnerability exists in the WordPress Toolkit used by cPanel and WHM hosting platforms. This flaw allows a user with a standard account on a shared server to bypass security boundaries and run administrative commands as if they were another user. This could lead to unauthorized access to other customers' websites, data theft, or full site compromise.

Vendors: cPanel.

Quick answers

Is CVE-2026-47365 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47365 being exploited in the wild.
How severe is CVE-2026-47365?: Critical severity, with a CVSS score of 9.9, published 12 June 2026.
Which products and versions are affected?: cPanel WordPress Toolkit before 6.11.0.
Is there a fix for CVE-2026-47365?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-47365 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-47365?: Check whether you run cPanel WordPress Toolkit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is classified as an argument injection (CWE-88) within the WordPress Toolkit component of cPanel & WHM. The flaw stems from improper neutralization of argument delimiters, which allows a remote authenticated user with low privileges to inject additional parameters into CLI commands. By exploiting this, an attacker can bypass cross-tenant isolation mechanisms and execute arbitrary 'wp-toolkit' commands with the permissions of a different account. This can lead to a complete compromise of other WordPress installations on the same server. The issue is resolved in WordPress Toolkit version 6.11.0.

Affected products

cPanel WordPress Toolkit before 6.11.0
cPanel WHM before 6.11.0

Timeline

2026-06-12: disclosed
2026-06-12: advisory

References

https://support.cpanel.net/hc/en-us/articles/41004584983703-WP-Toolkit-CVE-2026-47365

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.