Argument injection in WP Toolkit for cPanel versions 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts. This vulnerability stems from improper validation of command-line arguments and is classified as CWE‑88. The result is that an attacker with legitimate cPanel credentials can access sensitive files and run arbitrary code on any hosted site, compromising confidentiality, integrity, and availability of all affected accounts.

Affected product: WebPros WP Toolkit for cPanel. Versions 6.11.2-10794 and earlier are impacted; no later releases are known to contain the flaw. All customers running these versions should verify their installed version against the vendor release notes.

The CVSS score of 9.4 indicates critical severity, and the EPSS score is not available at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate to the cPanel account, and once logged in they can exploit the flaw. The CVE description does not provide details on the precise exploitation path; based on typical deployment, it is inferred that the attack could be carried out via local network or through a web interface that exposes the Toolkit. The impact is full remote code execution and data leakage across all customer sites managed in the same cPanel installation.