CVE-2026-58048: WebPros cPanel SQL injection via database renaming

CVE-2026-58048 · Severity: info · CVSS 9.4 · Published 2026-07-31

cPanel, a widely used web hosting control panel, contains a vulnerability that could allow a user with limited database access to gain full administrative control over the database server. By exploiting a flaw in how the system handles database renaming, an attacker can execute unauthorized commands with the highest level of system privileges (root). This could lead to the complete compromise of all customer data, website files, and database configurations managed by the affected server.

Technologies: WebPros cPanel. Vendors: WebPros.

Quick answers

Is CVE-2026-58048 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-58048 being exploited in the wild.
How severe is CVE-2026-58048?
Informational severity, with a CVSS score of 9.4, published 31 July 2026.
Which products and versions are affected?
WebPros cPanel < 11.110.0.137, < 11.118.0.71, < 11.126.0.78, < 11.134.0.48, < 11.136.0.32, < 11.137.9999.99.
Is there a fix for CVE-2026-58048?
A patch was published on 2026-07-29: Targeted Security Release 137.9999.98 published. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58048 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-58048?
Check whether you run WebPros cPanel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability (CWE-89) exists in cPanel and WP Squared due to the improper preservation of SQL modes during database renaming operations. An attacker with low-privileged network access (PR:L) can exploit this flaw to execute arbitrary SQL commands within the root context of the database server. The vulnerability stems from how the 'mvacct' flow and related database renaming scripts handle session-specific SQL settings, potentially allowing an attacker to bypass security boundaries. Successful exploitation results in a total loss of confidentiality, integrity, and availability across the entire system. Patches have been released in various version branches, including 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32, and 11.137.9999.99 for cPanel, and 11.138.1.6 for WP Squared.

Affected products

  • WebPros cPanel < 11.110.0.137, < 11.118.0.71, < 11.126.0.78, < 11.134.0.48, < 11.136.0.32, < 11.137.9999.99
  • WebPros WP Squared < 11.138.1.6

Timeline

  • 2026-07-29: patched: Targeted Security Release 137.9999.98 published.
  • 2026-07-31: disclosed: CVE record published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.