This vulnerability arises from unchecked argument injection within WP Toolkit for cPanel, allowing a local user to supply crafted parameters that are passed to untrusted code paths. The flaw results in execution of arbitrary commands as another account on the same server, granting the attacker the privileges of that account and potentially full system compromise, unauthorized data modification, or service disruption.

The affected product is WebPros WP Toolkit for cPanel. No specific affected versions are listed, so all instances may be vulnerable unless an updated release has been applied.

The CVSS score of 8.5 indicates a high risk level. Because EPSS is not available, the exact likelihood of exploitation in the wild cannot be quantified, but the absence of a KEV listing suggests it has not yet been widely exploited. The likely attack path involves a local user leveraging the injection flaw to execute arbitrary code as other accounts; no remote access is necessary, enabling privilege escalation and compromising confidentiality, integrity, and availability.