Full Report
WebPros security advisory (AV26-772)
Analysis Summary
# Vulnerability: WebPros (cPanel/WP Squared) Request Smuggling and Privilege Escalation
## CVE Details
**Vulnerability 1:**
- **CVE ID:** CVE-2026-58047
- **CVSS Score:** Not explicitly listed in advisory (Typically High for Smuggling)
- **CWE:** CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling)
**Vulnerability 2:**
- **CVE ID:** CVE-2026-58048
- **CVSS Score:** Not explicitly listed in advisory (Typically High for Privilege Escalation)
- **CWE:** CWE-269 (Improper Privilege Management / Privilege Escalation)
## Affected Systems
- **Products:** WP Squared, cPanel & WHM
- **Versions:**
- WP Squared: Prior to 11.138.1.6
- cPanel: Prior to 11.110.0.137
- cPanel: Prior to 11.118.0.71
- cPanel: Prior to 11.126.0.78
- cPanel: Prior to 11.134.0.48
- cPanel: Prior to 11.136.0.32
- **Configurations:** Systems running affected versions of cPanel/WHM and WP Squared administrative interfaces.
## Vulnerability Description
- **CVE-2026-58047 (HTTP Request Smuggling):** This flaw involves the inconsistent processing of HTTP requests between front-end and back-end systems. An attacker can craft malicious requests that allow them to "smuggle" a second request to the back-end, potentially bypassing security controls or hijacking user sessions.
- **CVE-2026-58048 (Database Privilege Escalation):** This flaw allows an authenticated user with limited database access to escalate their privileges within the database environment. This could lead to unauthorized data access, modification, or full administrative control over managed databases.
## Exploitation
- **Status:** Not currently reported as exploited in the wild; No public PoC provided in the advisory.
- **Complexity:** Medium
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Potential session hijacking and unauthorized database access)
- **Integrity:** High (Potential for unauthorized data modification)
- **Availability:** Medium (Potential for service disruption via malformed requests)
## Remediation
### Patches
WebPros has released updates to address these vulnerabilities. Administrators should update to the following versions or higher:
- **WP Squared:** 11.138.1.6
- **cPanel:** 11.110.0.137
- **cPanel:** 11.118.0.71
- **cPanel:** 11.126.0.78
- **cPanel:** 11.134.0.48
- **cPanel:** 11.136.0.32
### Workarounds
No specific workarounds were provided. Patching is the recommended course of action.
## Detection
- **Indicators of Compromise:** Unusual HTTP 400 or 502 errors in web server logs; unexpected database permission changes or administrative actions originating from low-privilege accounts.
- **Detection methods:** Review access logs for malformed Transfer-Encoding or Content-Length headers. Audit database user permissions for unauthorized escalations.
## References
- **Vendor Advisories:**
- hxxps[://]support[.]cpanel[.]net/hc/en-us/articles/42285024734743-Security-CVE-2026-58047-HTTP-Request-Smuggling
- hxxps[://]support[.]cpanel[.]net/hc/en-us/articles/42285745783703-Security-CVE-2026-58048-Database-Privilege-Escalation
- hxxps[://]support[.]cpanel[.]net/hc/en-us/sections/360007088193-Security
- **Cyber Centre Bulletin:**
- hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/webpros-security-advisory-av26-772