What’s Vulnerable › Vulnerabilities

CVE-2026-41940: WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-04-30
• EPSS: 98.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-29 · updated 2026-10-26
• Weakness: CWE-306

Description

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Affected products

• WebPros cPanel: from 11.40 before 86.0.41; from 88.0.0 before 110.0.97; from 112.0.0 before 118.0.63; from 120.0.0 before 124.0.35; from 126.0.1 before 126.0.54; from 128.0.0 before 130.0.19 — fixed in 86.0.41, 110.0.97, 118.0.63, 124.0.35, 126.0.54, 130.0.19
• WebPros WHM: from 11.40 before 86.0.41; from 88.0.0 before 110.0.97; from 112.0.0 before 118.0.63; from 120.0.0 before 124.0.35; from 126.0.1 before 126.0.54; from 128.0.0 before 130.0.19 — fixed in 86.0.41, 110.0.97, 118.0.63, 124.0.35, 126.0.54, 130.0.19
• WebPros WP Squared: before 136.1.7 — fixed in 136.1.7

How to fix

Upgrade to a fixed version: WebPros cPanel 86.0.41, 110.0.97, 118.0.63, 124.0.35; WebPros WHM 86.0.41, 110.0.97, 118.0.63, 124.0.35; WebPros WP Squared 136.1.7. Check the vendor advisory for mitigations.

In the news

• The Internet Is Falling Down, Falling Down, Falling Down (cPanel & WHM Authentication Bypass CVE-2026-41940)

References

• https://docs.cpanel.net/release-notes/release-notes
• https://docs.wpsquared.com/changelogs/versions/changelog/#13617
• https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026
• https://www.namecheap.com/status-updates/ongoing-critical-security-vulnerability-in-cpanel-april-28-2026
• https://www.vulncheck.com/advisories/cpanel-and-whm-authentication-bypass-via-login-flow
• https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/
• https://www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks/
• https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41940

Get alerted when CVE-2026-41940 or the next vulnerability affects your stack