# CVE-2026-29206: cPanel sqloptimizer SQL injection in utility script

Source: https://junglewise.ai/threats/cve-2026-29206-cpanel-sqloptimizer-sql-injection-in-utility-script  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-29206 · Severity: high · CVSS 8.1 · Published 2026-05-13

A security vulnerability has been identified in cPanel & WHM and WP Squared, popular web hosting control panels. The flaw exists in a utility script used for database optimization, which fails to properly clean data before processing it. If an attacker can trigger specific database logging conditions, they could execute unauthorized commands with administrative (root) privileges, potentially leading to full server compromise or data loss.

Technologies: [cPanel WP Squared](https://junglewise.ai/threats/technologies/wp-squared). Vendors: [cPanel](https://junglewise.ai/threats/vendors/cpanel).

## Quick answers

**Is CVE-2026-29206 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-29206 being exploited in the wild.

**How severe is CVE-2026-29206?** High severity, with a CVSS score of 8.1, published 13 May 2026.

**Which products and versions are affected?** cPanel WP Squared < 11.136.1.12.

**Is there a fix for CVE-2026-29206?** A patch was published on 2026-05-13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-29206 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-29206?** Check whether you run cPanel WP Squared at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the `sqloptimizer` utility script within cPanel & WHM and WP Squared. The root cause is insufficient sanitization of SQL queries processed by the script. When Slow Query logging is enabled, an attacker can craft malicious SQL statements that, when processed by the optimizer utility, execute with root-level privileges. While the attack vector is listed as network-based, it requires the 'Slow Query' logging precondition and some level of user interaction (UI:R) to trigger the script's execution on the malicious data. Successful exploitation allows for unauthorized data modification or service disruption. Patches have been released across multiple version branches.

## Affected products

- cPanel cPanel & WHM < 11.86.0.44, < 11.94.0.31, < 11.102.0.42, < 11.110.0.118, < 11.118.0.67, < 11.124.0.38, < 11.126.0.59, < 11.130.0.23, < 11.132.0.32, < 11.134.0.26, < 11.136.0.10
- cPanel WP Squared < 11.136.1.12

## Timeline

- 2026-05-13: disclosed
- 2026-05-13: advisory
- 2026-05-13: patched

## References

- [https://support.cpanel.net/hc/en-us/articles/40437213099159-Security-CVE-2026-29206-cPanel-WHM-WP2-Security-Update-May-13-2026](https://support.cpanel.net/hc/en-us/articles/40437213099159-Security-CVE-2026-29206-cPanel-WHM-WP2-Security-Update-May-13-2026)

## Related threats

- [SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle…](https://junglewise.ai/threats/cve-2026-32992-cpanel-dns-cluster-improper-certificate-validation)
- [Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the…](https://junglewise.ai/threats/cve-2026-29205-cpanel-whm-arbitrary-file-read-in-cpdavd-attachment-download)