CPanel has addressed a vulnerability allowing an authorized hosting user to perform SQL operations within the root context of the database, exceeding the privilege limits between their cPanel account and the server’s administrative database identity This article explores cpanel addressed vulnerability. . The bug is tracked as CVE-2026-58048 (CVSS 4.0 score: 9.4) and impacts all versions of cPanel & WHM, along with WP Squared.
Per the company’s database documentation, the system creates a replacement database, moves the original data, recreates grants and stored code, and then deletes the old database and its associated permissions.
The advisory and CVE record neither specify the injected input, the affected SQL mode, nor provide details on the exact payload or whether Team User sub-accounts meet the description of an authenticated account holder if they have database access. CPanel notes that this forces a new TCP and TLS connection for each request on ports 2083, 2087, and 2096, thereby increasing latency and CPU usage on busy servers. Exim has issued an advisory indicating that exploitation necessitates a redirect router with .forward handling capabilities, an accessible pipe transport, enabling of force_command on that transport, and running as a privileged user.
The database advisory includes build 11.118.0.71 in its patched releases; however, the request-smuggling and Exim advisories, published alongside this same update, omit the 11.118 branch entirely from their lists.
