Skip to content

CVE · Exploited · On CISA KEV

CVE-2026-41940

WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

9.3
CVSS 4.0
1
story
APR 30
added to KEV
Severity
9.3 Critical · vendor score
Vendor
WebPros
Product
cPanel & WHM and WP2 (WordPress Squared)
Published
Apr 29, 2026
Added to KEV
Apr 30, 2026
KEV deadline
May 3, 2026
Ransomware use
Known
Weakness
CWE-306

What it is

WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑
  1. VulnerabilitiesResearchers Warn of Critical cPanel Flaw CVE-2026-41940cPanel published a terse advisory saying that there was an issue with “session loading and saving” and that it affects every version of the software.DENNIS FISHER · 2 MIN

Official references

7 sources

Registries

RegistryNVDScore, weakness and every referenceRegistryCVE.orgThe official CVE recordRegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisorysupport.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026Analysisnamecheap.com/status-updates/ongoing-critical-security-vulnerability-in-cpanel-april-28-2026Analysisvulncheck.com/advisories/cpanel-and-whm-authentication-bypass-via-login-flowExploitlabs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940