A serious security vulnerability affecting cPanel & WHM as well as WP Squared has been identified, allowing authenticated users to perform unauthorized SQL commands with administrative authority. According to Security Affairs, the flaw is tracked as CVE-2026-58048 and carries a critical CVSS score of 9.4. By exploiting this issue, a user with standard database access privileges could potentially manipulate the database as root, which, depending on the server's specific operating system and configuration, may result in total system compromise.

The vulnerability originates during the database renaming process within the cPanel interface. When a user initiates a rename, the system generates a replacement database, migrates the existing data, and recreates the associated grants and code. During these operations, the SQL mode is not preserved accurately, creating an opening for elevated command execution that bypasses standard account restrictions. Security researcher Vincent55 Yang is credited with reporting this issue.

While cPanel describes the issue as a privilege escalation, the CNA record classifies the bug under CWE-89, the standard category for SQL injection. As of August 4, the US Cybersecurity and Infrastructure Security Agency (CISA) has designated the vulnerability as non-automatable, though it retains a high technical impact rating. Currently, there are no documented instances of active exploitation.

Why It Matters

This vulnerability highlights the fragility of automated administrative tasks in shared hosting environments. When systems automate the deletion and recreation of permissions, small oversights in state preservation can lead to critical security gaps. For hosting providers, this creates a potential liability regarding sub-account management, as it remains unclear if limited-permission Team User accounts can trigger the exploit. Organizations must treat internal database operations as high-risk workflows, moving beyond simple perimeter security to ensure that automated backend processes do not inadvertently grant escalated privileges to low-trust users.