cPanel has released a targeted security update addressing three vulnerabilities in cPanel and WHM, the most critical of which — tracked as CVE-2026-58048 with a CVSS 4.0 score of 9.4 — allows an authenticated hosting account holder to execute arbitrary SQL commands in the database's root administrative context. The flaw, responsibly disclosed by security researcher Vincent55 Yang, affects every supported version of cPanel and WHM as well as WP Squared prior to the patched builds released in this update. cPanel has warned that under certain operating system and database engine configurations, successful exploitation may extend beyond database access to full operating-system-level compromise — a consequence CISA's August 4 enrichment independently rated as having a total technical impact.
The flaw sits in cPanel's database-renaming process. According to the HackerOne CNA record, SQL mode is not preserved when a database is renamed — causing SQL to execute in the database's root administrative context rather than the restricted context normally granted to a cPanel user's account. Under standard cPanel operation, database-level privileges do not include SUPER access or global modification rights. CVE-2026-58048 bypasses those restrictions entirely, allowing the authenticated account holder to perform database operations as if they were the database administrator.
An attacker who achieves database administrative access through this flaw can read, modify, create, or delete databases and database objects beyond those assigned to their hosting account. Practically, this enables extraction of stored credentials, API keys, password hashes, customer records, and application configuration data belonging to any hosted website on the same server whose databases are accessible. Attackers may also create unauthorised database users, install persistence through database-stored objects, or chain the administrative database access with permissive filesystem permissions or local OS integrations to escalate from database root to operating system root in certain environments.
In shared hosting, reseller, and multi-tenant environments, the risk profile is significantly elevated. Low-privilege tenant accounts typically have default access to database management features as part of their standard hosting package — making every account on an affected shared server a potential exploit entry point. A compromised or deliberately malicious customer account can use CVE-2026-58048 to access other tenants' databases, manipulate hosted websites, or in worst-case configurations achieve server-wide OS compromise. CISA assessed the flaw as non-automatable, which limits the risk of mass scripted exploitation compared to an unauthenticated RCE — but the attacker population on a shared server is everyone who holds a cPanel account, including phished, resold, or malicious customers.
CVE-2026-58047, scoring 5.6 on the CVSS 4.0 scale, is an HTTP request-smuggling vulnerability in cpsrvd — the daemon serving the cPanel and WHM interfaces. An unauthenticated remote attacker may under limited conditions manipulate responses delivered to other users on the same server, with the CNA record noting that credentials could leak as a result. The interim workaround is to disable backend connection reuse via cpsrvd_keepalives_disabled=1 in the cPanel config, which increases latency but eliminates the smuggling vector. A third advisory covers GCVE-25-2026-07-45-3, an Exim .forward file vulnerability in which unsafe string expansion in the redirect router can be triggered by a local user and may allow privilege escalation — fixed in Exim 4.99.5. Administrators on the 11.118 branch should verify their specific point release against the database advisory, as published advisory lists from cPanel are inconsistent across these three releases.
Update cPanel and WHM to one of the following patched builds immediately: 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32, or WP Squared 138.1.6. The update can be applied via WHM or by running /usr/local/cpanel/scripts/upcp --force. Where patching cannot happen immediately, revoke the MySQL feature from all cPanel user feature lists through the WHM feature-list manager — existing databases will remain operational but users will be prevented from adding or removing databases until the patch is applied.