This vulnerability in WP Toolkit for cPanel (versions <=6.11.2-10794) is due to improper neutralization of argument delimiters, classified as CWE-88. Remote authenticated users can exploit this argument injection flaw to read arbitrary files and execute arbitrary code across multiple customer accounts, leading to potential full compromise of affected systems. The CVSS 4.0 score is 9.4, indicating a critical severity with network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, availability, and security requirements.

Successful exploitation allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts, potentially compromising confidentiality, integrity, and availability of the affected systems and data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to authenticated users and monitor for suspicious activity related to WP Toolkit for cPanel.