CVE-2026-41940—WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

漏洞名称

WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

描述

WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

已知用于勒索软件活动吗？

勒索软件状态：

KNOWN

采集行动

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

其他说明

• https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026
• https://docs.cpanel.net/release-notes/release-notes/
• https://docs.wpsquared.com/changelogs/versions/changelog/#13617
• https://nvd.nist.gov/vuln/detail/CVE-2026-41940"

相关新闻文章

• Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole ServerAugust 28, 2026
• CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively ExploitedAugust 5, 2026
• Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM ServersJuly 23, 2026
• LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts as RootMay 23, 2026
• cPanel CVE-2026-41940 Under Active Exploitation to Deploy Filemanager BackdoorMay 11, 2026

相关 CWE

• CWE-306