CRITICALCVSS 9.8Actively exploited · CISA KEV since 2026-04-30Vulnerability

CVE-2026-41940

WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Properties

Euvd product
cPanel, WHM, WP Squared
Vulnerability name
WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability
First seen
2026-09-30T17:20:17+00:00
Cvss score
9.8
Epss score
0.98527
Last seen
2026-10-19T12:00:27+00:00
Due date
2026-05-03
Euvd assigner
VulnCheck
Retrieved at
2026-10-21T01:24:49+00:00
Exploited euvd since
2026-04-30T00:00:00+00:00
Src batch id
epss_history-20261020T103617Z-728ddd
Source url
https://epss.empiricalsecurity.com/epss_scores-2026-10-19.csv.gz
Date added
2026-04-30
Score
9.8
Euvd base score version
4.0
Fetched at
2026-10-20T10:36:20+00:00
Euvd vendor
WebPros, cPanel
Cvss vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In Signal since
initial import (Sep 2026)
Euvd base score
9.3

Related Entities (8)

AFFECTS_PRODUCT (3)

→[Product]cpe:2.3:a:cpanel:wp_squared:*:*:*:*:*:wordpress:*:*
→[Product]cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*
→[Product]cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:*

MENTIONED_IN (2)

→[Campaign]Large-Scale GitHub Actions Abuse Powers a Distributed cPanel and WHM Exploitation Campaign
→[Campaign]Mysterious hacker organization operating secretly for 6 years is exploiting critical cPanel vulnerability to deploy backdoor trojans

DESCRIBES (1)

←[KEVEntry]WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

HAS_WEAKNESS (1)

→[Weakness]Missing Authentication for Critical Function

INVOLVES (1)

←[Signal]kev_added · 2026-04-30

Explore deeper with Ninja Signal's threat intelligence graph

Search in SpektrOpen Signal Desktop
CVE-2026-41940 (CVSS 9.8) — Ninja Signal Threat Intelligence | Ninja Signal