CVE-2026-41940

Vulnerability classified as CWE-306 (Missing Authentication for Critical Function) is caused by an error in the login flow that does not require proper authentication for critical panel functions. A remote, unauthenticated attacker can exploit this over the network (AV:N) without any additional conditions (AC:L, AT:N) and without user interaction (UI:N) to bypass authentication mechanisms and gain unauthorized access to the cPanel/WHM panel.

Attacker gains full unauthorized access to cPanel or WHM control panel, which in practice means the ability to take over managed hosting accounts, modify server configuration, steal data, and install malicious software on hosted websites and the server.

Immediately apply the security update described by the manufacturer in the article 'cPanel & WHM Security Update 04-28-2026' (https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026). Detailed patched version numbers are available in the manufacturer's release notes and WP Squared changelog. Until the patch is implemented, it is recommended to restrict access to cPanel/WHM panel ports (default 2082, 2083, 2086, 2087) exclusively to trusted IP addresses at the firewall level.

cPanel and WHM as well as cPanel WP Squared in versions after 11.40 — detailed list of affected versions indicated in manufacturer's references (docs.cpanel.net and support.cpanel.net).

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.