{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T19:10:46.198Z",
  "tag": {
    "id": "cpanel",
    "label": "cPanel",
    "isStack": false,
    "url": "https://pwn.watch/t/cpanel",
    "feed": "https://pwn.watch/t/cpanel/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940",
      "title": "WebPros cPanel & WHM and WP2 (WordPress Squared): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability",
      "url": "https://pwn.watch/i/webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940",
      "json": "https://pwn.watch/i/webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "WebPros cPanel & WHM and WP2 (WordPress Squared)",
      "tags": [
        "wordpress",
        "hosting",
        "cpanel",
        "ransomware",
        "cisa-kev",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2026-41940"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-04-30",
      "closedAt": "2026-04-30",
      "updatedAt": "2026-04-30",
      "summary": "WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. Added to CISA KEV on 2026-04-30.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940",
      "incidentTitle": "WebPros cPanel & WHM and WP2 (WordPress Squared): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-04-30",
      "title": "CISA added CVE-2026-41940 to the KEV catalog (due 2026-05-03).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940"
    }
  ]
}