CVE-2026-41940
Missing Authentication for Critical Function in WebPros cPanel & WHM and WP2 (WordPress Squared). CISA confirmed attackers exploit it and added it to its Known Exploited Vulnerabilities catalog on 30 April 2026.
- Product
- WebPros cPanel & WHM and WP2 (WordPress Squared)
- Added to CISA's catalog
- Federal fix-by date
- Ransomware
- Known to be used in ransomware
- Vendor advisories
- Sources
- CISA’s catalog, NVD entry
CISA’s description.
WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
Every flaw CISA confirmed exploited in the last 30 days is on the exploit watch. This is not security advice. Check the vendor’s advisory before acting. From CISA’s catalog of 4 November 2026.