CVE record
CVE-2026-41940
WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability
WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
CVE evidence
Known exploitation
Listed in CISA KEV
Absence from the fetched catalog does not establish that exploitation has not occurred.
Severity
unknown
No parseable CVSS vector returned
Affected packages
0
Supported package records returned by OSV. Vendor and product names are not used to infer matches.
CISA Known Exploited Vulnerabilities
Catalog record
- Vendor / project
- WebPros
- Product
- cPanel & WHM and WP2 (WordPress Squared)
- Date added
- Apr 30, 2026
- CISA federal remediation due date
- May 3, 2026
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known ransomware campaign use
- Known
- CWE
- CWE-306
OSV package mapping
Affected open-source packages
OSV did not return a package mapping in the five supported ecosystems. RequestGuard does not infer package names from the CISA vendor or product fields.