Argument injection in WebPros WP Toolkit for cPanel enables cross-account file access and code execution

Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts.

• WebPros WP Toolkit for cPanel: affected from version 0 through and including 6.11.2-10794 according to the CNA's structured affected data.
• The cPanel advisory identifies 6.11.2-10794 and older versions as affected and describes 6.11.3 or later as patched.
• The structured record returned by NVD and GCVE identifies 6.11.3-10850 as unaffected. The status of parallel or otherwise unlisted branches is not established by these sources and should not be inferred.

WebPros WP Toolkit for cPanel contains an argument injection flaw in the handling of database-creation commands. The weakness falls under CWE-88 and occurs when argument delimiters are not properly neutralized, allowing attacker-controlled data to alter command processing. The attacker must be a remote authenticated cPanel user who can reach the relevant functionality over the network. The available evidence confirms arbitrary file reads, arbitrary code execution, and database modifications affecting other customer accounts. The specific request parameter, endpoint, command construction, and execution privilege context are not established by the available sources.

The flaw is remotely reachable over the network and requires an authenticated cPanel account; the record characterizes the required privileges as low, attack complexity as low, and user interaction as unnecessary. The supplied record sets public_exploit to false and leaves known_exploited as null. The CISA ADP data returned in the consulted record marks exploitation as none and automatable as no, but that assessment does not prove exploitation cannot occur in every environment. No public exploit, exploit chain, campaign, victim, or specific indicator is identified in the available evidence.

The confirmed technical outcomes are arbitrary file reads, arbitrary code execution, and database modifications affecting other customer accounts. Because access requires an authenticated cPanel user, the flaw is not described as completely unauthenticated access, but it still breaks tenant boundaries in multi-account environments. Possible consequences include loss of data confidentiality, unauthorized application changes, and service disruption; the actual result depends on the account's permissions, execution context, and the server's isolation controls. The available sources do not establish whether attacker-controlled code runs with root privileges or with a restricted service identity.

An authenticated cPanel account may cross customer-account boundaries when the affected WP Toolkit is deployed.

• Arbitrary file reads may expose configuration or application data belonging to another customer account.
• Arbitrary code execution and database modifications can alter application content, configuration, or state for multiple customers.
• In shared-hosting environments, the flaw may allow impact to spread from one controlled account to other tenants on the same system, although the available evidence does not establish the exact execution privilege context.
• The available record does not identify a specific breach, campaign, victim, or realized loss.

1. Update WP Toolkit for cPanel: the cPanel advisory identifies 6.11.3 or later as patched. The structured record also identifies 6.11.3-10850 as unaffected.
2. Apply the update to every cPanel server running WP Toolkit, especially systems hosting multiple customer accounts, and verify the installed package version after deployment.
3. If an update cannot be applied immediately, restrict unnecessary cPanel access and increase review of activity from authenticated accounts. This is only a temporary risk-reduction measure; the available evidence does not provide a vendor-confirmed standalone mitigation.
4. After updating, review earlier database changes and other cross-account activity for signs that the vulnerable functionality may have been used.

1. Inventory WP Toolkit for cPanel on every cPanel server, including systems hosting multiple customer accounts, and compare deployed versions with the affected and fixed boundaries in affected_summary.
2. Confirm the result of the vendor update process and recheck the installed version after deployment rather than relying only on the cPanel version.
3. Where suitable telemetry exists, review cPanel and WP Toolkit authentication and operational logs for database-creation activity, database changes outside the user's account, unusual file reads, or unexpected code execution. Treat this as a precautionary review, not as a confirmed IOC search.
4. No specific log signature or indicator of compromise has been published. The absence of suspicious events should not be treated as proof that a system is safe.