A newly disclosed privilege-escalation vulnerability in cPanel & WHM could allow authenticated hosting users to execute arbitrary database commands with full administrative privileges.
Tracked as CVE-2026-58048, the flaw affects cPanel & WHM’s database-management functionality across all supported versions until patched releases are installed.
According to cPanel, an attacker must first possess a valid cPanel account and access to the MySQL or MariaDB database feature.
cPanel & WHM Flaw
This reduces exposure compared with unauthenticated remote code execution bugs, but the issue remains significant in shared-hosting, reseller, managed-service, and multi-tenant environments where untrusted users may hold legitimate cPanel credentials.
The vulnerability allows a qualifying cPanel user to potentially issue arbitrary database commands with administrative-level privileges.
In practice, this could enable an attacker to read, modify, create, or remove databases and database objects outside the permissions normally granted to their hosting account.
Database administrative access can have wide-reaching consequences. An attacker could access sensitive application records, including customer information, configuration data, authentication materials, API keys, or password hashes, stored by hosted websites.
They may also alter application data, create unauthorized database users, or disrupt hosted services through destructive SQL commands.
cPanel warned that the impact may extend beyond the database layer, depending on the underlying operating system and database engine configuration.
In certain deployments, administrative database privileges could be chained with insecure database settings or operating-system integrations to achieve operating-system-level compromise.
This possibility makes the flaw particularly concerning for environments where MySQL or MariaDB instances have elevated filesystem permissions, permissive plugin configurations, or local integrations that could be abused after administrative database access is obtained.
Affected and Patched Versions
CVE-2026-58048 affects all supported cPanel & WHM versions prior to the relevant fixed release. Administrators should update to one of the following patched versions or later:
| Product | Patched Version |
|---|---|
| cPanel/WHM | 11.110.0.137 |
| cPanel/WHM | 11.118.0.71 |
| cPanel/WHM | 11.126.0.78 |
| cPanel/WHM | 11.134.0.48 |
| cPanel/WHM | 11.136.0.32 |
| WP Squared (WP2) | 138.1.6 |
Organizations should verify the installed build rather than relying only on the major release branch. Systems managed through automatic update policies may already be protected, but administrators should confirm successful deployment across production, staging, and reseller infrastructure.
The primary recommendation is to update cPanel & WHM to the latest patched version as soon as operationally possible. Before upgrading, administrators should follow their standard change-management process, including backups, compatibility checks, and post-update verification.
For servers that cannot be patched immediately, cPanel recommends temporarily revoking the MySQL feature from affected cPanel users through feature-list management.
This mitigation does not delete or disable existing databases; instead, it prevents users from adding or removing database resources through cPanel. Administrators should prioritize feature removal for low-trust, dormant, reseller, and externally managed accounts.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
