—–BEGIN PGP SIGNED MESSAGE—–

Hash: SHA256

Privilege Escalation Vulnerability in cPanel & WHM

Indian – Computer Emergency Response Team (https://www.cert-in.org.in)

Severity Rating: CRITICAL

Software Affected

cPanel & WHM (Web Host Manager) versions

prior to 11.136.0.32 

prior to 11.134.0.48 

prior to 11.126.0.78 

prior to 11.110.0.137 

WP Squared version prior to 138.1.6

Overview

A vulnerability has been reported in in cPanel & WHM, which could allow a remote attacker to gain elevated privileges and execute arbitrary database commands with full administrative privileges on the targeted system.

Target Audience:

Organizations and individuals using affected cPanel & WHM-based hosting environments.

Risk Assessment:

High risk of Privilege escalation and operating-system level compromise.

Impact Assessment:

Potential for execution of arbitrary database commands with full administrative privileges.

Description

cPanel & WHM is a widely used web hosting control panel that provides administrative (WHM) and user-level (cPanel) interfaces for managing servers and websites.

This vulnerability exists in cPanel & WHM due to improper preservation of SQL mode during database renaming in cPanel. A remote authenticated attacker could exploit this vulnerability to execute arbitrary database commands with full administrative privileges.

Successful exploitation of this vulnerability could allow the attacker to gain elevated privileges and execute arbitrary database commands with full administrative privileges on the targeted system.

Solution

Apply appropriate fix/patches as mentioned:

https://support.cpanel.net/hc/en-us/articles/42285745783703-Security-CVE-2026-58048-Database-Privilege-Escalation

Vendor Information

cPanel

https://support.cpanel.net/hc/en-us/articles/42285745783703-Security-CVE-2026-58048-Database-Privilege-Escalation

References

cPanel

https://support.cpanel.net/hc/en-us/articles/42285745783703-Security-CVE-2026-58048-Database-Privilege-Escalation

CVE Name

CVE-2026-58048

– —

Thanks and Regards,

CERT-In

Incident Response Help Desk

e-mail: incident@cert-in.org.in

Phone: +91-11-22902657

Toll Free Number: 1800-11-4949

Toll Free Fax : 1800-11-6969

Web: http://www.cert-in.org.in

PGP Fingerprint: A768 083E 4475 5725 B81A A379 2156 C0C0 B620 D0B4

PGP Key information:

https://www.cert-in.org.in/s2cMainServlet?pageid=CONTACTUS

Postal address:

Indian Computer Emergency Response Team (CERT-In)

Ministry of Electronics and Information Technology

Government of India

Electronics Niketan

6, C.G.O. Complex

New Delhi-110 003

—–BEGIN PGP SIGNATURE—–

iQIzBAEBCAAdFiEE6r4Iam/Ey0c/KakL3jCgcSdcys8FAmp7EQMACgkQ3jCgcSdc

ys8geQ//bpd4lWhyneve2Mit07yQcmUcIsKrbgXuCK6Hi92v08+Ud65PYuORUpsk

1ASzqZwLwUWSIEn4UkvRMODeyef2QQL2goCyes2Alhmc/8Ub4fbsDzXA6t3TMF6p

OHe8fkjE7SeXZZEFRfb2ETmtPJszHNC4xyrTwNBU5zo6ALpc/WA8AwXImP7P+OK6

8Dun0PhWN1hBKshjxm8dO0MSM5ae3kARzscCp8WxSyc5VB/zP0Q8gJarTVd7EXRF

+t4CrGJZLkRgl8pYwF2YHCDhny5F21E8eDIWgmrXK+dLCbRGdQ6q1QrwsrLbSSAB

oRXHgnLjahmxkFaMs6TcYyIllQCyz93RNkQYXRgBQ2845xc6o/NRehFErahIjiTn

+j5S9oSSFucJs9J21AWUjpan7bkppEzHTxxK56QbxF1EA/64r+zny0DdXdQXgEWn

WrqqIv+ZMhVFworKk5anq34na4RWEwzYe1QAF+hAYGo8C6fCPrXiV4pG5ztu6zE5

Q5GriFvg/yncw6ZmLmcUXe8TZfrIQVUDwW/fdj6FtAvwobS7rwwNp4yMbl8l/cwb

Dx/WiqEjW2fxQ64mhPoA8k3Geki3vPcCY2bGEvtQaRFB1ZTRwCiFEFgdeawzYOKa

V1F1hXwWwFVmm3ZIUwDqd5PIeULxz422ingWh8kxnnLhAI+1igo=

=KBmt

—–END PGP SIGNATURE—–