CVE-2026-58048 — cPanel & WHM Database Privilege Escalation via Database Rename (SQL Mode Loss) — Threadlinqs Intelligence
As of 2026-08-04, CVE-2026-58048 — cPanel & WHM Database Privilege Escalation via Database Rename (SQL Mode Loss) is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 5 indicators of compromise.
Threat ID: TL-2026-1862 · Severity: CRITICAL · CVSS: 9.4 · Status: ACTIVE · Category: VULNERABILITY
A critical privilege escalation vulnerability in cPanel & WHM (all supported version tiers) and WP Squared allows an authenticated low-privileged cPanel user to escalate to full database administrator
CVE-2026-58048 is a critical SQL injection vulnerability discovered by security researcher Vincent55 Yang (via HackerOne) in WebPros' cPanel, WHM, and WP Squared products. The flaw carries a CVSS 4.0 base score of 9.4 (CRITICAL) with the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, indicating network-based exploitation with low complexity, no attack requirements, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability with scope change to subsequent systems. The CNA record classifies this as CWE-89 (SQL Injection), while the cPanel advisory describes it as a privilege escalation bug — both characterize the same underlying flaw.
The root cause lies in the improper preservation of SQL mode during the database rename workflow in cPanel. When a user initiates a database rename, cPanel's root-owned daemon performs the following sequence: (1) builds a replacement database, (2) migrates the data over, (3) recreates grants and stored code, and (4) deletes the original database and its permissions. During this process, the SQL mode (a MySQL/MariaDB server setting that controls SQL syntax behavior and operational constraints) is not correctly re-applied to the replacement database. This creates a window where an attacker-influenced input in the rename path is interpreted by the MySQL/MariaDB server with root-level database privileges rather than the confined low-privileged user context, enabling arbitrary SQL execution.
cPanel is a Linux-based web-hosting control panel that brokers unprivileged user actions (such as database creation, renaming, and deletion) into privileged operations performed by root-owned daemons against the underlying MySQL/MariaDB server. The vulnerability exists in this root-context daemon path where the rename operation fails to preserve the SQL mode. The discrepancy between the cPanel advisory (privilege escalation) and the CNA classification (CWE-89 SQL Injection) reflects the same technical reality: the SQL mode loss during rename enables root-level SQL injection through a mechanism that manifests as privilege escalation.
The vulnerability affects all supported cPanel & WHM version tiers prior to the respective fixed builds: 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, and 11.136.0.32, as well as version 11.137.9999.99. WP Squared (WebPros' managed-WordPress hosting platform) is also affected prior to build 11.138.1.6, as it shares the same vulnerable code path. The prerequisite for exploitation is a valid cPanel account with the MySQL/MariaDB feature enabled. It remains unclear whether Team User sub-accounts (delegated limited-permission logins) qualify as exploit-capable authenticated holders — this is an open question that should be verified with cPanel support.
The CISA SSVC assessment (via the vulnrichment program) reports no known exploitation observed in the wild as of August 1, 2026, and assesses the vulnerability as not automatable but with total technical impact. The EPSS score is 0.503% (40th percentile), indicating low predicted exploitation probability within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the 'Critical' severity designation reflects the potential impact, not current exploitation volume — if exploited, the attacker gains full read/write/delete access to all databases on the server, with potential for OS-level compromise depending on database engine configuration (e.g., MySQL/MariaDB's LOAD DATA INFILE, SELECT INTO OUTFILE, or user-defined function capabilities that can execute OS commands).
Fixed builds have been released across all supported cPanel & WHM release tiers. The primary remediation is to upgrade to the cPanel 138 release series or the specific patched builds listed above. Enabling cPanel's automatic-update mechanism will pick up the patched tier on the standard release cadence. As a compensating control, administrato
Target sectors: web-hosting, managed-wordpress, cloud-infrastructure, saas, shared-hosting, reseller-hosting
Target regions: Global
Detections & IOCs
As of 2026-08-07, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 5 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-58048, T1059, T1562, T1552, T1087, T1082, T1005, T1560, T1505, T1048, T1485
