WebPros security advisory (AV26-772)
Serial Number: AV26-772 Date: August 4, 2026 As of July 31, 2026, WebPros is affected by vulnerabilities in the following products: WP Squared Prior to 11.138.1.6 cPanel Prior to 11.110.0.137 Prior to 11.118.0.71 Prior to 11.126.0.78 Prior to 11.134.0.48 Prior to 11.136.0.32 Prior to 138.1.6 ( WP2 ) The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Security: CVE-2026-58047 HTTP Request Smuggling – cPanel Security: CVE-2026-58048 Database Privilege Escalation – cPanel cPanel Security
Details
Original advisory: https://cyber.gc.ca/en/alerts-advisories/webpros-security-advisory-av26-772
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-580470.45% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 37% of all scored CVEs.
- Low exploitation riskCVE-2026-580480.50% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 40% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-58047 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-58048 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
More from Canadian Centre for Cyber Security
- unknownVeeam security advisory (AV26-777)2026-08-04
- unknownAdobe security advisory (AV26-776)2026-08-04
- unknownN-able security advisory (AV26-769) - Update 12026-08-04
- unknownMISP security advisory (AV26-775)2026-08-04
- unknownCheckpoint security advisory (AV26-774)2026-08-04