Skip to main content

Cpanel EUVDEUVD-2026-30203

| CVE-2026-29206 HIGH
SQL Injection (CWE-89)
2026-05-13 hackerone GHSA-7pf6-43fc-mx36
SQLi Cpanel Wp Squared Cpanel Cloudlinux 6 Centos 6 Webpros
8.1
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-89
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK

2 techniques across 2 tactics: Initial Access, Persistence

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 08, 2026

SQL injection in the cPanel/WHM sqloptimizer utility script allows attackers to execute arbitrary SQL queries as the MySQL root user when Slow Query logging is enabled. The flaw affects multiple cPanel branches (11.86 through 11.136), WP Squared, and the CloudLinux 6/CentOS 6 builds, with no public exploit identified at time of analysis. EPSS is low (0.03%) and SSVC marks exploitation as 'none', but technical impact is rated total because the injection runs with full database privileges.

Affected VersionsENISA

cPanel 11.136.0.0 <11.136.0.10
cPanel 11.124.0.0 <11.124.0.38
cPanel (CloudLinux 6, CentOS 6) 11.110.0.0 <11.110.0.118
cPanel 11.130.0.0 <11.130.0.23
cPanel 11.30.0.0 <11.86.0.44
WP Squared 11.136.1.0 <11.136.1.12
cPanel 11.134.0.0 <11.134.0.26
cPanel 11.102.0.0 <11.102.0.42
cPanel 11.126.0.0 <11.126.0.59
cPanel 11.132.0.0 <11.132.0.32
cPanel 11.94.0.0 <11.94.0.31
cPanel 11.110.0.0 <11.110.0.119
cPanel 11.118.0.0 <11.118.0.67

Affected Packages

euvd cpanel fix: 11.86.0.44, 11.94.0.31, 11.102.0.42, 11.110.0.119, 11.118.0.67, 11.124.0.38, 11.126.0.59, 11.130.0.23, 11.132.0.32, 11.134.0.26, 11.136.0.10
euvd cpanel_cloudlinux_6_centos_6 fix: 11.110.0.118
euvd wp_squared fix: 11.136.1.12

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Cpanel gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

2
Patch available
May 14, 2026 - 02:01 EUVD
CVE Published
May 13, 2026 - 22:07 nvd
HIGH 8.1

DescriptionCVE.org

Insufficient sanitization of SQL queries in the sqloptimizer utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled.

Executive ViewAI

Why It Matters

cPanel/WHM, the widely deployed hosting control panel, contains a critical SQL injection vulnerability (CVE-2026-29206) that permits arbitrary database queries with MySQL root privileges when Slow Query logging is enabled. Although no public exploit has been identified at the time of analysis, affected organizations face direct exposure to complete data compromise and system manipulation. The combination of broad cPanel adoption, high severity (CVSS 8.1), and total technical impact makes immediate patching essential despite currently low exploitation probability.

Recommended Action

Within 24 hours: inventory all cPanel/WHM deployments and identify which have Slow Query logging enabled (prioritize highest-risk systems first). Within 7 days: apply vendor-released patch to all affected cPanel versions (11.86-11.136) and WP Squared installations, validating in non-production environments before production deployment. Within 30 days: disable or restrict Slow Query logging where operationally unnecessary, and audit all patched systems to confirm remediation.

Business Impact: High
Compensating Controls

Apply vendor patch. Interim mitigation: disable Slow Query logging on affected cPanel installations until patching is complete, as this feature must be enabled for the vulnerability to be exploited.

Threat Intelligence Overview

EPSS Score
0.0%
Top 92% exploitable
Social Media
1
Sightings
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

40
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +40
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

SQL Injection HIGH

SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.

More in Cpanel

View all
CVE-2026-67401 CRITICAL POC
9.9 Sep 09

Root-level remote code execution in WebPros cPanel is achievable by any mail-enabled account through a SQL injection fla
CVE-2023-29489 MEDIUM POC
6.1 Apr 27

An issue was discovered in cPanel before 11.109.9999.116. Rated medium severity (CVSS 6.1), this vulnerability is remote
CVE-2018-16236 MEDIUM POC
6.1 Aug 30

cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is

CVE-2026-93698 CRITICAL
9.9 Oct 02

OS command injection in cPanel and WP Squared allows an authenticated, low-privileged hosting account holder to execute

CVE-2020-26108 CRITICAL
9.8 Sep 25

cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488). Rated critical severit
CVE-2020-26105 CRITICAL
9.8 Sep 25

In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554). Rated critical severit
CVE-2020-26101 CRITICAL
9.8 Sep 25

In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549). Rated critical severit
CVE-2020-26100 CRITICAL
9.8 Sep 25

chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497). Rated critical severity (CVSS 9.8), this vulnerability
CVE-2020-26098 CRITICAL
9.8 Sep 25

cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485). Rated critical severit
CVE-2020-10121 CRITICAL
9.8 Mar 17

cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546). Rated critical s
CVE-2020-10119 CRITICAL
9.8 Mar 17

cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544). Rated c
CVE-2026-87900 CRITICAL
9.4 Sep 23

Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows a remote authenticated (low-privileged, PR:L

Same weakness CWE-89 – SQL Injection

View all
CVE-2023-48788 CRITICAL POC
9.8
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8

Same technique SQLi

View all
CVE-2013-0333 HIGH POC
7.5

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-29206 ADVISORY https://vuldb.com/vuln/363759 REF https://support.cpanel.net/hc/en-us/articles/40437213099159-Security-CVE-2026-29206-cPanel-WHM-WP2-Security-Update-May-13-2026

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy