CVE-2026-29206

Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled.

Score

CVSS 3.1 8.1 High

Status

Deferred - support@hackerone.com

Published

2026-05-13

Last modified

2026-10-26

Weaknesses

CWE-89

Affected products

• Centos 6 (Webpros)
• Cpanel (Webpros)
• Cpanel Cloudlinux 6 (Webpros)
• Wp Squared (Webpros)

References

• https://support.cpanel.net/hc/en-us/articles/40437213099159-Security-CVE-2026-29206-cPanel-WHM-WP2-Security-Update-May-…