WebPros cPanel & WHM and WP2 (WordPress Squared): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability
› WebPros cPanel & WHM and WP2 (WordPress Squared)
Get an email when a new major security incident drops. No spam, unsubscribe any time.
- started
- Apr 30, 2026
- closed
- Apr 30, 2026
- CVEs
- 1
- sources
- 3
## summary
WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. Added to CISA KEV on 2026-04-30.
severity: Actively exploited (CISA KEV); known ransomware use
## cve ids[1]
## affected
- See vendor advisory / CISA notes (versions not always listed in KEV feed)
## fixed in
- See vendor advisory linked in sources
## timeline[1]
CISA added CVE-2026-41940 to the KEV catalog (due 2026-05-03).
## advisories[2]
## news & write-ups[1]
## notes & caveats
Derived from CISA KEV JSON feed catalogVersion 2026.10.21. Exact affected/fixed version strings are not always in the KEV record — verify against the vendor advisory URL. startedAt uses dateAdded (exploitation may have begun earlier).
