cPanel & WHM (all supported versions), WP Squared
cPanel is the control panel software that web hosting companies use to let customers manage websites, email accounts, and databases through a browser interface. WHM (Web Host Manager) sits above it, used by hosting administrators to manage the server itself.
Root Cause
The flaw lives in cPanel's database-renaming process. When a database is renamed, the system creates a replacement, moves data, recreates permissions, and removes the old database. SQL mode is not preserved during this process, causing subsequent SQL to execute in the database's root administrative context rather than the user's restricted one. The HackerOne CNA classifies this as CWE-89 (SQL injection), though cPanel's own advisory frames it as privilege escalation — two valid descriptions of the same underlying failure.
Attack Vector
An attacker with a valid cPanel account triggers the database-rename workflow. Because SQL mode drops to root context mid-operation, commands they supply run with full administrative database privileges. From there, depending on configuration, the path to operating-system access may be short.
Detection Notes
Review database audit logs for unexpected SUPER-privilege operations or schema changes from non-administrative cPanel accounts. Look for database rename events followed immediately by unusual stored procedure creation or user grants. Monitor for unexpected OS-level activity from the database process user.
Recommended Actions
- Update to a patched build: 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32, or 138.1.6 for WP Squared.
- If immediate patching is not possible, revoke the MySQL/MariaDB feature from cPanel user accounts in WHM as a temporary mitigation.
- Audit which cPanel accounts currently have database access and restrict to those with a genuine need.