What is the CVSS score of CVE-2026-32991?

CVE-2026-32991 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of cPanel are affected by CVE-2026-32991?

CVE-2026-32991 in cPanel and WP Squared allows team members to gain unauthorized ownership of hosting accounts, risking customer data and service disruption.. A patch is available.

How to fix or mitigate CVE-2026-32991?

Within 24 hours: Identify all cPanel and WP Squared systems and prioritize critical production instances. Within 7 days: Apply the available vendor patch to all affected systems and verify the escalation vulnerability is resolved. Within 30 days: Review team member account access patterns and audit logs for any unauthorized privilege changes.

cPanel CVE-2026-32991

EUVD-2026-30205 HIGH

Incorrect Authorization (CWE-863)

2026-05-13 hackerone

GHSA-cg6m-ghv2-fh4r

Authentication Bypass Cpanel Wp Squared Cpanel Cloudlinux 6 Centos 6

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 08:42 vuln.today

Patch available

May 14, 2026 - 02:01 EUVD

CVE Published

May 13, 2026 - 22:07 nvd

HIGH 7.1

DescriptionCVE.org

Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account.

AnalysisAI

Privilege escalation in cPanel and WP Squared allows an authenticated team member account to elevate privileges to the team owner, granting full control over the hosting account. The flaw stems from improper authorization checks within the team-member privilege model and carries a CVSS 7.1 (high integrity impact). EPSS is very low (0.03%) and no public exploit has been identified at time of analysis, but a vendor patch is available.

Technical ContextAI

cPanel is a widely deployed web hosting control panel used to manage shared hosting accounts, and WP Squared (WP2) is its WordPress-focused variant; both implement a 'Team Manager' feature that allows the primary account owner to delegate scoped privileges to additional team-member sub-users. The vulnerability is rooted in CWE-863 (Incorrect Authorization), meaning the application performs authorization but applies the wrong check or evaluates privileges against the wrong subject - in this case, the privilege boundary between a team member and the team owner is not enforced consistently. The affected CPEs cover the standard cPanel build, the legacy cPanel build for CloudLinux 6 / CentOS 6, and WP Squared, indicating the broken check lives in shared team-privilege code paths rather than a single product-specific module.

RemediationAI

Apply the vendor-released patch for your release tier as published in the cPanel May 13, 2026 security update (https://support.cpanel.net/hc/en-us/articles/40437254183959-Security-CVE-2026-32991-cPanel-WHM-WP2-Security-Update-May-13-2026): upgrade to cPanel 11.136.0.10, 11.134.0.26, 11.132.0.32, 11.130.0.23, 11.126.0.59, 11.124.0.38, 11.118.0.67, 11.110.0.119 (or 11.110.0.118 for the CloudLinux 6 / CentOS 6 build), or WP Squared 11.136.1.12 - most cPanel installations on the STABLE/RELEASE tiers will pick this up via the normal upcp auto-update process. As a compensating control until patched, audit Team Manager and remove or suspend untrusted team-member accounts via WHM's Manage Team interface (this disables delegation but preserves owner access), and consider lowering each team member's role to the minimum privileges actually needed since the flaw escalates from any team-member role to owner. If you cannot patch quickly, also rotate the primary account password and API tokens after patching in case escalation already occurred.