pwn.watch: cPanel incident updates https://pwn.watch/t/cpanel Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 30 Apr 2026 00:00:00 GMT [high] WebPros cPanel & WHM and WP2 (WordPress Squared): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability https://pwn.watch/i/webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940 https://pwn.watch/i/webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940 Thu, 30 Apr 2026 00:00:00 GMT high <p>WebPros cPanel &amp; WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. Added to CISA KEV on 2026-04-30.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2026-04-30: CISA added CVE-2026-41940 to the KEV catalog (due 2026-05-03).</li></ul> <p><strong>CVEs:</strong> CVE-2026-41940</p>