ZeroDay Findings
Sign inSign up

Findings

CVE-2026-41940

WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

Published Apr 29, 2026 · updated Sep 30, 2026 · WebPros cPanel & WHM and WP2 (WordPress Squared)

WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 29, 2026 · Catalog

    Detected

    WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

  2. Apr 30, 2026 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  3. May 3, 2026 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  4. Sep 30, 2026 · Catalog

    Updated

    WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date May 3, 2026

Affected

  • cpe cpanel/cpanelversion unspecified
  • cpe cpanel/whmversion unspecified
  • cpe cpanel/wp squaredversion unspecified
  • vendor WebPros cPanel & WHM and WP2 (WordPress Squared)version unspecified

Sources

  • CISA KEVCVE-2026-41940

    WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

    cisa.gov
  • CVE.orgCVE-2026-41940

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2026-41940

    30-day exploitation probability 98.5%

    first.org
  • Exploit Database52574

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_multi/http/cpanel_whm_auth_bypass_rce

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2026-41940

    cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

    nvd.nist.gov

References