This vulnerability in WordPress Toolkit before version 6.11.0 enables remote authenticated users to perform argument injection attacks by exploiting improper neutralization of argument delimiters. This flaw allows attackers to bypass cross-tenant authorization and execute arbitrary CLI commands under the context of another user account, potentially leading to full compromise of affected accounts. The CVSS 3.1 base score is 9.9, reflecting its critical impact with network attack vector, low attack complexity, and high confidentiality, integrity, and availability impacts. No official patch or remediation level has been provided in the available data.

Successful exploitation allows an authenticated remote attacker to bypass authorization boundaries between tenants and execute arbitrary commands on behalf of other user accounts. This can lead to full compromise of those accounts, including unauthorized access to data and control over WordPress Toolkit operations. The vulnerability poses a critical risk to multi-tenant environments using affected versions of WordPress Toolkit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor the vendor's security advisories for updates. Until a patch is available, restrict access to authenticated users only to trusted personnel and consider additional access controls to limit potential exploitation.