WordPress Toolkit EUVD-2026-36376

Requires an authenticated cPanel account on a server running WordPress Toolkit older than 6.11.0 with the WordPress Toolkit feature enabled for the attacker's package, and the attacker must reach a WordPress Toolkit action whose parameters are passed through to the wp-toolkit CLI. No user interaction is needed and the attacker does not need admin/WHM privileges (PR:L). Exploitation is limited to environments where multiple tenants coexist on the same host (otherwise there is no cross-tenant target) and to servers where the operator has not yet upgraded to 6.11.0 or disabled the feature for untrusted packages.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H rates this 9.9 because exploitation only needs a low-privilege authenticated account, no user interaction, and crosses a security scope (one tenant impacts another). The scope change is the dominant risk driver: on a shared hosting node, any paying customer becomes a path to every other customer's WordPress data. EPSS and KEV data were not provided in the input, so probability of mass exploitation is unmeasured; this CVE is not currently in CISA KEV and no public exploit identified at time of analysis. The realistic priority is high for shared-hosting operators running cPanel & WHM even without KEV, because the attacker prerequisite (a low-tier hosting account) is trivially obtainable.

An attacker purchases or compromises any low-tier cPanel hosting account on a shared server, authenticates to cPanel, and invokes a WordPress Toolkit action whose parameters they control. They craft a value that begins with a CLI flag (e.g., an account-selection option) so that when WordPress Toolkit shells out to wp-toolkit, the injected flag retargets the command at a different tenant's WordPress site - letting them dump credentials, install a malicious plugin, or alter content owned by another customer.