SINGAPORE, 7 AUG 2026 — A flaw in cPanel and WHM lets an authenticated customer run SQL statements as database root. On a shared server, Singapore's Cyber Security Agency warns, that reaches the databases belonging to everyone else on the box.
Shared hosting is how a very large share of small businesses in this region put a website online. The isolation between one customer and the next is the entire product.
What the flaw does
CVE-2026-58048 is a database privilege escalation issue, scored 9.4 out of 10 on CVSS v4.0. It requires authentication, but that’s no barrier here. On a shared host, any customer is an authenticated cPanel user, including one who signed up an hour ago for a few dollars a month.
| CVE-2026-58048 | |
|---|---|
| Products | cPanel & WHM; WP Squared |
| CVSS v4.0 | 9.4 |
| Precondition | An authenticated cPanel user |
| Effect | Execute SQL statements with database root privileges |
| On shared hosting | Unauthorised access to, or manipulation of, databases belonging to other customers on the same server |
| Possible escalation | Operating system compromise, depending on OS and database configuration |
| Fixed in | cPanel & WHM 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32; WP Squared 138.1.6 |
From CSA alert AL-2026-097 of 5 August 2026. The version numbers are the thresholds CSA lists — all supported versions prior to those releases are affected. CSA does not report active exploitation.
CSA also notes that depending on the operating system and database configuration, exploitation may lead to operating system compromise. That is the difference between reading a neighbour's data and owning the machine both of you are on.
Why the multi-tenant detail is the story
Most vulnerability reporting is written for the organisation that runs the software. This one has a second audience that will never read an advisory.
On a shared server, the customer at risk is not the one who has to patch. A small business with a brochure site and a customer enquiry database cannot see the provider's control panel version, cannot check it, and has no contractual way to demand an update. Their exposure is entirely a function of somebody else's maintenance schedule.
The threat model is also unusually cheap to enter. Getting authenticated access to a shared host does not require compromising anyone. It requires buying an account on the same server, which is a routine commercial transaction.
A low-cost entry, a high-value privilege, and a victim who can’t act: this combination makes tenant isolation failures far more dangerous than the same score on an enterprise product.
Five branches, one back-port
The list of patched versions says something about who is exposed.
CSA lists fixed releases across five separate cPanel and WHM branches, from the 11.110 line through to 11.136, plus a WP Squared release. A vendor issuing fixes across five supported branches simultaneously is back-porting rather than telling everyone to move to the newest version.
That is the correct decision and it exists because of how this market works. Hosting providers run older branches deliberately, since a control panel upgrade risks every customer site on the server at once, and the incentive is to stay on a branch that is known to work. A fix only available on the newest branch would therefore have reached the least of the estate.
It also means the version number a provider quotes is not self-explanatory. A server on 11.118.0.71 is patched; a server on 11.126.0.50 is not, despite the higher number. The branch matters, not the ordering.
What an authenticated cPanel user is
The precondition — an authenticated user — does a lot of quiet work.
On a dedicated server, an authenticated cPanel user is an administrator or a colleague. On a shared server it is a customer, and shared servers are shared with strangers. A single machine may host dozens or hundreds of accounts for unrelated businesses. Each gets a control panel login and can create databases and run queries against their own data.
The security model rests entirely on the database layer refusing to let one account's queries touch another account's data. This flaw is a failure of exactly that refusal, which is why the score is 9.4 despite requiring a login that costs a few dollars.
The escalation note extends it further. CSA says that depending on the operating system and database configuration, exploitation may lead to operating system compromise — which would put an attacker above the control panel rather than merely across it.
What a hosting customer can actually do
Very little directly, which is worth saying rather than pretending otherwise.
What is available is a question to the provider, and a specific one is better than a general one. Asking whether they are secure produces reassurance. Asking which cPanel and WHM build they are running, and when it was applied, produces either a version number or a silence, and both are informative.
The other step is architectural and unglamorous. The most exposed databases sit on shared hosting because that is where the website is. If the data is sensitive — customer records, order histories, anything with personal identifiers — it does not belong on shared hosting. This flaw is a reminder, not a new reason.
What a provider should be doing
Patching to the listed releases is the whole of the mechanical answer, and the version thresholds run across five supported branches, which suggests cPanel has back-ported the fix rather than expecting everyone onto the newest branch.
Providers should also disclose the issue to customers. A provider that patched quietly leaves every tenant unable to assess whether their data was reachable during the exposure window. Nothing compels that disclosure, and a provider that offers it is doing something its competitors are not.
Where this sits in the week
This was one of six alerts and advisories CSA published between 3 and 7 August. The others covered VMware, Cisco twice, a Singapore-built endpoint security product, and an npm supply-chain worm.
Two of the six describe the same class of failure at different layers. This one breaks the boundary between customers on a shared server; the VMware set includes a flaw allowing an attacker with local administrative privileges on a virtual machine to execute code on the host underneath it.
Different products from different vendors, but the same shape of failure: a system sold on the promise of a boundary that does not actually hold.
The audience this reaches last
There is a structural problem in how flaws like this are communicated, and it is not CSA's to fix.
A national CERT publishes to organisations that read advisories. Hosting providers are in that group. The businesses whose data is at stake are not: they are a bakery with an order form, a clinic with an appointment page, a shop with a customer list, and none of them subscribes to alert feeds.
So the party bearing the risk learns nothing, while the party able to act faces no pressure from those affected. Regulation could close that gap by requiring disclosure to tenants; nothing currently does in most of the region.
What to watch
Two things.
The first is whether exploitation is reported. CSA does not describe this as being exploited, and an authenticated-user precondition on widely deployed hosting software is the kind of thing that attracts attention once a patch reveals the mechanism.
The second is whether any regional hosting provider publishes its patch status. If none does, that is the answer to how much visibility a shared-hosting customer has, and it is not a good one.
View author profile → · Editorial policy
