cPanel CVE-2026-58048: SQL Injection Enables Database Root Access

Step by step
How the attack unfolded
Click a phase for details – or let the animation play through.
PHASE 1/5 · Initial Access

The attacker logs in to the web interface using a valid, legitimate cPanel account.

T1078 – Valid Accounts T1190 – Exploit Public-Facing Application
  • Prerequisite: valid cPanel account with MySQL/MariaDB feature enabled
  • Access via the cPanel interface (login URL ending in :2083 or /cpanel)
  • Especially relevant in shared-hosting environments with many external customers
  • No victim interaction required, network-based attack
PHASE 2/5 · Execution

A SQL injection is smuggled in during a database rename via the cPanel UAPI.

T1190 – Exploit Public-Facing Application T1059 – Command and Scripting Interpreter
  • Vulnerability CVE-2026-58048, CVSS 9.4 (critical), SQL injection (CWE-89)
  • PoC sets SQL mode to 'ANSI_QUOTES' and passes a crafted database name
  • Rename flaw: the SQL mode is not correctly preserved
  • Public proof-of-concept code available; abuses the UAPI interface
PHASE 3/5 · Privilege Escalation

The injected commands run in the database root context with full administrative privileges.

T1068 – Exploitation for Privilege Escalation
  • Escape from the restricted account scope into the database root context
  • Execution of arbitrary database commands with full admin privileges
  • Escalation up to OS-level compromise possible (depending on configuration)
  • CISA SSVC assessment: Technical Impact 'total'
PHASE 4/5 · Collection & Lateral Movement

With root privileges the attacker can access all databases of every customer on the server.

T1005 – Data from Local System T1213 – Data from Information Repositories
  • Access to databases of dozens of other customers on the same shared server
  • Affected: WordPress, WooCommerce shops, CRM systems, contact form data
  • Second flaw CVE-2026-58047 (CVSS 5.6, HTTP Request Smuggling) can intercept others' credentials
  • cPanel manages over 70M domains worldwide (market share ~22–23%)
PHASE 5/5 · Impact

Full compromise of confidentiality, integrity and availability of all server data.

T1485 – Data Destruction T1565 – Data Manipulation
  • CVSS vector: full impact on confidentiality, integrity and availability
  • Possible theft of customer data, orders and contact form entries
  • Potential data breach with GDPR reporting obligations for affected companies
  • Remediation: patch to ≥ 11.110.0.137 / 11.118.0.71 / 11.126.0.78 / 11.134.0.48 / 11.136.0.32
Short & clear answers
Frequently asked questions about this incident
Am I affected by CVE-2026-58048?
All cPanel & WHM versions prior to the patched releases are affected, as well as WP Squared before 138.1.6. Check whether your site runs cPanel (the login URL ends in :2083 or /cpanel) and read the version number in the cPanel interface or via the SSH command /usr/local/cpanel/cpanel -V. Shared-hosting environments, where multiple unrelated customers share one server with the MySQL/MariaDB feature enabled, are especially at risk.
What should I do right now to protect myself?
Update cPanel immediately — as root via SSH using /usr/local/cpanel/scripts/upcp --force, or in WHM under 'Upgrade to Latest Version'. If you can't update straight away, apply the workaround of disabling the MySQL feature for all cPanel users in the WHM 'Feature Manager'. On managed hosting, contact your provider and ask for written confirmation that the update has been applied.
Which cPanel versions are protected against this flaw?
The patched versions are 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32, and WP Squared 138.1.6. Your installed version must therefore be at least the number matching your release branch. cPanel released the patches on 29–30 July 2026 in a targeted security release.
How can I tell if my server has already been attacked?
Review your database logs from around 29 July 2026 onward for unusual activity. Red flags include unknown database renames, newly created database users with admin rights, unexpected GRANT commands, and unusual file access by the database process. Such traces may indicate that the vulnerability has already been exploited.
Do I have to report a possible breach under GDPR?
If a compromise cannot be ruled out and personal data (e.g. customer records, orders, contact-form entries) is stored on the server, you should assess a GDPR notification. A reportable data breach must generally be reported to the competent data protection supervisory authority. When in doubt, involve your data protection officer.
More security news
You might also be interested in
Critical Elementor Pro Flaw: Attackers Can Fully Take Over WordPress Sites
A file upload bug in Elementor Pro up to 4.2.1 allows RCE without login. Version 4.2.2 fixes the flaw – update now!
Pods Plugin: Critical Flaw Enables Admin Takeover, No Login
A critical flaw in the WordPress plugin Pods lets attackers overwrite admin passwords without login. Over 100,000 sites are affected.
miniOrange SAML SSO: Critical Bypass Turns Attackers Into Admins
Two critical auth bypasses in the miniOrange SAML SSO plugin allow forged SAML assertions—up to full WordPress admin access.