Swati KhandelwalAug 04, 2026Vulnerability / Database Security
cPanel has patched a flaw that let an authenticated hosting customer execute SQL in the database's root context, crossing the privilege boundary between a cPanel account and the server's administrative database identity. It shipped in a targeted security release that closes two other routes past account boundaries.
The database bug is tracked as CVE-2026-58048 (CVSS 4.0 score: 9.4) and affects all supported versions of cPanel & WHM, along with WP Squared. Reaching it requires a valid cPanel account and access to the MySQL/MariaDB feature. From there, the vendor says the account holder could execute arbitrary database commands with full administrative privileges.Depending on the operating system and database engine configuration, “this may extend to operating-system-level compromise.”
cPanel patched CVE-2026-58048 in these builds:
138.1.6 for WP Squared
