VULNERABILITY INTELLIGENCE

CVE-2026-41940

CVSS score9.8 CRITICAL
EPSS probability98.53%
CISA KEVKnown exploited vulnerability
Published2026-04-29
Last modified2026-10-26
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

Vendor / product: WebPros / cPanel & WHM and WP2 (WordPress Squared)

Description

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Weakness classification

  • disclosure@vulncheck.com: CWE-306

Primary references