WP Toolkit EUVD-2026-85619

Requires an authenticated but low-privileged account (PR:L) on a cPanel server where the WP Toolkit extension (version 6.11.2-10794 or earlier) is installed and reachable over the network - a standard configuration for shared-hosting customers. No user interaction and no elevated privileges are needed; any legitimate customer login (or a compromised/self-registered customer account) suffices. What LIMITS exploitation: the attacker must possess valid authenticated access to the panel, WP Toolkit must be present and enabled (not all cPanel deployments install it), and the version must be at or below 6.11.2-10794. The defining amplifier is the multi-tenant context - impact crosses into other customers' accounts (scope/subsequent-system change), so single-tenant or WP-Toolkit-absent hosts are not exposed.

This is a genuine high-priority vulnerability, not an inflated CVSS artifact. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring only low privileges - the level a routine cPanel customer account holds - with no user interaction. Critically, all three subsequent-system impact metrics are High (SC:H/SI:H/SA:H), which encodes the description's 'across customer accounts' language: this is a multi-tenant boundary breakout where a single low-privileged customer can read files and execute code affecting OTHER customers on the same shared host. That combination (trivial preconditions + cross-tenant total compromise) is why the vendor score reaches 9.4. Exploitation-probability signals are entirely absent from the input: no EPSS score, no CISA KEV listing, and no explicit POC are provided, so the real-world exploitation likelihood cannot be quantified - treat urgency as derived from impact and low attack barrier, not from observed exploitation. The report originated via HackerOne (support@hackerone.com), consistent with coordinated disclosure rather than in-the-wild discovery. No conflicting signals exist between the vector and description; both agree on remote authenticated argument injection leading to RCE.

A low-privileged attacker signs up for or compromises an ordinary hosting customer account on a cPanel server running WP Toolkit, then submits crafted input to a WP Toolkit operation that is passed as command-line arguments to an underlying tool. By injecting additional arguments they coerce that command to read files belonging to other customers or execute arbitrary code, escaping their own account's boundary and compromising co-tenants on the shared server. No public exploit code is identified in the provided data, though the flaw was reported through HackerOne.