CVE-2026-41940 WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function

What is CVE-2026-41940?

CVE-2026-41940 is a critical authentication bypass vulnerability in Cpanel Cpanel, published on 29 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Weakness: CWE-306

Which versions are affected by CVE-2026-41940?

It affects 3 products.

Products include Cpanel Cpanel, Cpanel Whm, Cpanel Wp Squared.

How do I fix CVE-2026-41940?

No fix has been published for CVE-2026-41940 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 May 2026.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-41940 being exploited?

Yes. Attackers have exploited CVE-2026-41940 in the wild since at least 30 Apr 2026, including in ransomware campaigns.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 73 proofs of concept on GitHub.

Other vulnerabilities in Cpanel Cpanel

• CVE-2003-1425 guestbook.cgi in cPanel 5.0 allows remote attackers to execute arbitrary commands via the template parameter. Critical 10.0
• CVE-2004-1769 Code injection in n/a Critical 10.0
• CVE-2004-1770 Command injection in n/a Critical 10.0
• CVE-2020-26098 Command injection in n/a Critical 9.8
• CVE-2020-26100 Privilege escalation in n/a Critical 9.8

All Cpanel Cpanel vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-85qr-8rxc-62gv.