Executive brief
cPanel, a widely used web hosting control panel, contains a vulnerability that could allow a user with limited database access to gain full administrative control over the database server. By exploiting a flaw in how the system handles database renaming, an attacker can execute unauthorized commands with the highest level of system privileges (root). This could lead to the complete compromise of all customer data, website files, and database configurations managed by the affected server.
Technical details
A SQL injection vulnerability (CWE-89) exists in cPanel and WP Squared due to the improper preservation of SQL modes during database renaming operations. An attacker with low-privileged network access (PR:L) can exploit this flaw to execute arbitrary SQL commands within the root context of the database server. The vulnerability stems from how the 'mvacct' flow and related database renaming scripts handle session-specific SQL settings, potentially allowing an attacker to bypass security boundaries. Successful exploitation results in a total loss of confidentiality, integrity, and availability across the entire system. Patches have been released in various version branches, including 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32, and 11.137.9999.99 for cPanel, and 11.138.1.6 for WP Squared.
Affected products
- WebPros cPanel < 11.110.0.137, < 11.118.0.71, < 11.126.0.78, < 11.134.0.48, < 11.136.0.32, < 11.137.9999.99
- WebPros WP Squared < 11.138.1.6
Timeline
- 2026-07-29: patched: Targeted Security Release 137.9999.98 published.
- 2026-07-31: disclosed: CVE record published.