CVE-2026-41940 | cPanel and WHM versions after 11.40 contain an authenticatio… | CVSS 9.8 CRITICAL

Description

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Metadata

CVE ID: CVE-2026-41940
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-04-22 18:50 UTC
Published: 2026-04-29 15:10 UTC
Last updated: 2026-05-06 15:48 UTC
Primary CWE: CWE-306
CWE-306 Missing Authentication for Critical Function
Vendor / Product: WebPros / cPanel
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: ACTIVE
Automatable: yes
Tech. Impact: total

CISA Known Exploited Vulnerability

Vulnerability name: WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability
Vendor: WebPros
Product: cPanel & WHM and WP2 (WordPress Squared)
Added to KEV: 2026-04-30
Due date: 2026-05-03
Ransomware: Known use

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA description

WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Affected products (3)

Vendor	Product	Platform	Versions
WebPros	cPanel	—	11.40.0.0 < 11.86.0.41, 11.88.0.0 < 11.94.0.28, 11.96.0.0 < 11.102.0.39, 11.104.0.0 < 11.110.0.97 …
WebPros	WHM	—	11.40.0.0 < 11.86.0.41, 11.88.0.0 < 11.94.0.28, 11.96.0.0 < 11.102.0.39, 11.104.0.0 < 11.110.0.97 …
WebPros	WP Squared	—	11.136.1.7

Weakness (CWE)

CWE	Source	Description
CWE-306	cna	CWE-306 Missing Authentication for Critical Function

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (5)