CVE-2026-41940—WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

Vulnerability Name

WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

Description

WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Known To Be Used in Ransomware Campaigns?

Ransomware Status:

KNOWN

Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Additional Notes

• https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026
• https://docs.cpanel.net/release-notes/release-notes/
• https://docs.wpsquared.com/changelogs/versions/changelog/#13617
• https://nvd.nist.gov/vuln/detail/CVE-2026-41940"

Related News Articles

• Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM ServersJuly 23, 2026
• LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts as RootMay 23, 2026
• cPanel CVE-2026-41940 Under Active Exploitation to Deploy Filemanager BackdoorMay 11, 2026
• cPanel, WHM Release Fixes for Three New Vulnerabilities — Patch NowMay 9, 2026
• Multiple threat actors actively exploit cPanel vulnerability (CVE-2026-41940)May 4, 2026

Related Weaknesses

• CWE-306