cPanel just shipped a security release that closes a hole most hosting customers never knew existed. Specifically, it let an ordinary, authenticated account run SQL commands with full administrative database privileges.
CVE-2026-58048 carries a CVSS 4.0 score of 9.4, and it touches every supported version of cPanel & WHM plus WP Squared. To exploit it, an attacker only needs a valid cPanel account with access to the MySQL or MariaDB feature, and plenty of regular customers already have that.
From there, cPanel says the account holder could run arbitrary database commands as if they held root access. Depending on the server’s OS and database setup, that access could even reach the operating system itself.
The bug sits in cPanel’s database-renaming process. Normally, when a database gets renamed, the system should preserve SQL mode throughout the move. Instead, it doesn’t, so the SQL ends up executing in the database’s administrative context. cPanel labels this privilege escalation, while HackerOne’s own record classifies the same defect as SQL injection. Either way, neither one names the exact payload or the affected SQL mode.
Fortunately, patches are already live in builds 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32, and 138.1.6 for WP Squared. For anyone who can’t update immediately, revoking the MySQL feature from cPanel users works as a stopgap. That way, existing databases keep running, but users lose the ability to add or remove new ones.
Meanwhile, two smaller issues shipped alongside it. First, CVE-2026-58047 is a request-smuggling bug in cpsrvd that could let an unauthenticated attacker manipulate responses meant for other users, and as a result, credentials could leak. Second, an Exim flaw could let Team User sub-accounts escalate privileges through a local user’s .forward file. Fortunately, Exim 4.99.5 removes the vulnerable code that made that possible.
So far, CISA‘s August 4 enrichment found no active exploitation and rated the flaw non-automatable, though that’s only a snapshot from that date. Meanwhile, one more wrinkle is worth flagging: cPanel’s own advisories don’t fully agree on which builds carry the fix. Therefore, anyone running build 11.118 specifically should check the database advisory directly instead of relying on the shorter lists in the other two.
