CVE Tools
Track your stack

New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root

The Hacker NewsBy The Hacker News

PatchcPanel & WHMWP Squared

Our summary

cPanel has addressed a critical vulnerability allowing authenticated users to execute SQL commands in the database root context, potentially leading to full system compromise. Tracked as CVE-2026-58048 (CVSS score 9.4), it impacts all supported versions of cPanel & WHM and WP Squared. Attackers need valid account access and MySQL/MariaDB privileges to exploit this flaw. The fix was included in several updated builds, including 11.110.0.137 and 138.1.6 for WP Squared. Administrators unable to update immediately should temporarily disable MySQL access for cPanel users.

Read at The Hacker News

The Hacker News publishes this story on its own site; we link to it rather than reprint it.

  1. The Hacker NewsCritical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole ServerCVE-2026-58047, CVE-2026-58048
  2. The Hacker NewsNew cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as RootCVE-2026-58048
  3. The Hacker News⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and MoreCVE-2026-58048
  4. The Hacker News⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router BackdoorsCVE-2026-58048

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store