# CVE-2026-58048 — cPanel & WHM Database Privilege Escalation via Database Rename (SQL Mode Loss)

> A critical privilege escalation vulnerability in cPanel & WHM (all supported version tiers) and WP Squared allows an authenticated low-privileged cPanel user to escalate to full database administrator access by renaming a database. The SQL mode is not preserved during the rename, enabling SQL commands to execute with root-level database authority. Depending on the operating system and database engine configuration, this may extend to operating-system-level compromise. Fixed builds are available across all supported release tiers.

- **Published:** 2026-08-04T00:00:00Z
- **Last reviewed:** 2026-08-04T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1862
- **ID:** TL-2026-1862
- **Severity:** CRITICAL (CVSS 9.4)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 5 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-58048

## Description

CVE-2026-58048 is a critical SQL injection vulnerability discovered by security researcher Vincent55 Yang (via HackerOne) in WebPros' cPanel, WHM, and WP Squared products. The flaw carries a CVSS 4.0 base score of 9.4 (CRITICAL) with the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, indicating network-based exploitation with low complexity, no attack requirements, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability with scope change to subsequent systems. The CNA record classifies this as CWE-89 (SQL Injection), while the cPanel advisory describes it as a privilege escalation bug — both characterize the same underlying flaw.

The root cause lies in the improper preservation of SQL mode during the database rename workflow in cPanel. When a user initiates a database rename, cPanel's root-owned daemon performs the following sequence: (1) builds a replacement database, (2) migrates the data over, (3) recreates grants and stored code, and (4) deletes the original database and its permissions. During this process, the SQL mode (a MySQL/MariaDB server setting that controls SQL syntax behavior and operational constraints) is not correctly re-applied to the replacement database. This creates a window where an attacker-influenced input in the rename path is interpreted by the MySQL/MariaDB server with root-level database privileges rather than the confined low-privileged user context, enabling arbitrary SQL execution.

cPanel is a Linux-based web-hosting control panel that brokers unprivileged user actions (such as database creation, renaming, and deletion) into privileged operations performed by root-owned daemons against the underlying MySQL/MariaDB server. The vulnerability exists in this root-context daemon path where the rename operation fails to preserve the SQL mode. The discrepancy between the cPanel advisory (privilege escalation) and the CNA classification (CWE-89 SQL Injection) reflects the same technical reality: the SQL mode loss during rename enables root-level SQL injection through a mechanism that manifests as privilege escalation.

The vulnerability affects all supported cPanel & WHM version tiers prior to the respective fixed builds: 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, and 11.136.0.32, as well as version 11.137.9999.99. WP Squared (WebPros' managed-WordPress hosting platform) is also affected prior to build 11.138.1.6, as it shares the same vulnerable code path. The prerequisite for exploitation is a valid cPanel account with the MySQL/MariaDB feature enabled. It remains unclear whether Team User sub-accounts (delegated limited-permission logins) qualify as exploit-capable authenticated holders — this is an open question that should be verified with cPanel support.

The CISA SSVC assessment (via the vulnrichment program) reports no known exploitation observed in the wild as of August 1, 2026, and assesses the vulnerability as not automatable but with total technical impact. The EPSS score is 0.503% (40th percentile), indicating low predicted exploitation probability within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the 'Critical' severity designation reflects the potential impact, not current exploitation volume — if exploited, the attacker gains full read/write/delete access to all databases on the server, with potential for OS-level compromise depending on database engine configuration (e.g., MySQL/MariaDB's LOAD DATA INFILE, SELECT INTO OUTFILE, or user-defined function capabilities that can execute OS commands).

Fixed builds have been released across all supported cPanel & WHM release tiers. The primary remediation is to upgrade to the cPanel 138 release series or the specific patched builds listed above. Enabling cPanel's automatic-update mechanism will pick up the patched tier on the standard release cadence. As a compensating control, administrators can temporarily revoke the MySQL/MariaDB feature from cPanel users (which does not disable existing databases — it only prevents creation and removal of databases) or restrict database rename permissions to trusted administrators. On shared hosting environments, patching should be prioritized for nodes with numerous or untrusted tenants to reduce the exposure window. Auditing recent database rename operations for suspicious activity is also recommended.

## MITRE ATT&CK

- T1059 Command and Scripting Interpreter
- T1685 Disable or Modify Tools
- T1552 Unsecured Credentials
- T1087 Account Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1505 Server Software Component
- T1048 Exfiltration Over Alternative Protocol
- T1485 Data Destruction
- T1565 Data Manipulation

## Sources

- [Security Affairs — CVE-2026-58048: cPanel bug enables full database administrator access](https://securityaffairs.com/196595/security/cve-2026-58048-cpanel-bug-enables-full-database-administrator-access.html)
- [cPanel Official Advisory — CVE-2026-58048 Database Privilege Escalation](https://support.cpanel.net/hc/en-us/articles/42285745783703-CVE-2026-58048-Database-Privilege-Escalation)
- [NVD Detail — CVE-2026-58048](https://nvd.nist.gov/vuln/detail/CVE-2026-58048)
- [GitHub Advisory — GHSA-xgvx-cwxw-9vpj](https://github.com/advisories/GHSA-xgvx-cwxw-9vpj)
- [CISA Vulnrichment — CVE-2026-58048 SSVC Assessment](https://github.com/cisagov/vulnrichment/blob/develop/2026/58xxx/CVE-2026-58048.json)
- [cPanel 138 Change Log](https://docs.cpanel.net/changelogs/138-change-log)
- [CVE.org Record — CVE-2026-58048](https://www.cve.org/CVERecord?id=CVE-2026-58048)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1862