NetSight
IP …
critical9.8Known exploitedPublic exploit code

CVE-2026-41940

WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

Exploited in the wild

This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2026-04-30. Federal due date: 2026-05-03.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Affected products

VendorProductAffected versions
CpanelCpanel
from 11.40 before 86.0.41
from 88.0.0 before 110.0.97
from 112.0.0 before 118.0.63
from 120.0.0 before 124.0.35
from 126.0.1 before 126.0.54
from 128.0.0 before 130.0.19
CpanelWhm
from 11.40 before 86.0.41
from 88.0.0 before 110.0.97
from 112.0.0 before 118.0.63
from 120.0.0 before 124.0.35
from 126.0.1 before 126.0.54
from 128.0.0 before 130.0.19
CpanelWp Squared
before 136.1.7

Weakness classification

CWE-306

References