CVE-2026-41940 — Vulnerability intelligence

WebPros — cPanel & WHM and WP2 (WordPress Squared)

Published: 2026-04-29T15:10:37.899Z

CVSS

9.3

CISA KEV

Known exploitation

Original source text (not a translation)

WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Sources

• WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• CVE-2026-41940