Loading vulnerability…
Database privilege escalation in cPanel & WHM
CVE-2026-58048 is a database privilege-escalation vulnerability affecting cPanel & WHM and WP Squared. Improper preservation of SQL mode during database renaming allows an authenticated cPanel account holder with MySQL or MariaDB feature access to execute arbitrary SQL in the database root context. The rename workflow creates a replacement database, transfers existing data, recreates grants and stored code, and removes the original database and its grants. Exploitation bypasses the account's normal database privilege restrictions and may lead to operating-system-level compromise, depending on the operating system and database engine configuration. The exact injected input, affected SQL mode, and exploitation payload are not publicly specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation grants full database administrative privileges, potentially exposing customer databases and credentials and allowing modification of database users, permissions, and stored code. Database capabilities may also permit filesystem access. Depending on the operating system, database engine configuration, and filesystem privileges, the impact may extend to operating-system-level compromise or complete server compromise.
If you can’t patch tonight, do this now.
If patching must be delayed, temporarily revoke the MySQL feature from cPanel users through feature list management. Existing databases continue running, but users cannot add or remove databases through cPanel. Review database audit logs for unexpected administrative SQL activity, newly created database users, unusual privilege assignments, modified stored procedures, and suspicious file-related database operations.
Patch, then assume compromise.
Install the applicable patched cPanel & WHM build: 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, or 11.136.0.32, or a later fixed release in the corresponding branch. For WP Squared, install build 138.1.6, also identified as 11.138.1.6, or later. Administrators can install updates through WHM or force a cPanel update using its update utility.
2 exploits validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
60 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.