cPanel's 8 September 2026 advisory is titled SQL injection in EmailTrack. The body says an authenticated account with mail-related privileges can create arbitrary files through EmailTrack, and that success is code execution as root. All supported versions. Patched builds: 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4, and WP Squared 11.138.1.9.

Credit to Ali Mustafa (rz1027) and abed1526. No CVSS and no exploitation claim on the vendor page. Separate from the August domain-parking flaw and from the April login bypass.

Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: cPanel)