CVE-2026-41940
Authentication bypass in cPanel and WHM lets unauthenticated attackers gain control panel access
An authentication bypass in the login flow of cPanel and WHM lets unauthenticated remote attackers gain unauthorized access to the control panel; cPanel and WHM versions after 11.40 are affected. CISA's known-exploited entry also names WP2 (WordPress Squared) and lists fixed releases for it. CISA added the vulnerability to its known-exploited list on 2026-04-30, meaning it is being actively exploited, and US federal agencies must fix by 2026-05-03.
WebPros cPanel & WHM and WP2 (WordPress Squared) · Updated 28 Oct · From 1 of our story and the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 30 Apr; US agencies must fix by 3 May. Used by ransomware gangs
SeveritycriticalCVSS 9.3 of 10
FixAvailableFixed versions below
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| WP Squared 11.136 | 11.136.1.7 |
| cPanel 11.136 | 11.136.0.5 |
| WHM 11.136 | 11.136.0.5 |
| cPanel 11.134 | 11.134.0.20 |
What to do
- Update to the fixed release for your branch: cPanel and WHM 11.136.0.5, 11.134.0.20, 11.132.0.29, 11.130.0.19, 11.126.0.54, 11.124.0.35, 11.118.0.63, 11.110.0.97, 11.102.0.39, 11.94.0.28, or 11.86.0.41, and WP Squared 11.136.1.7.
- After updating, review login records and system logs for any unauthorized access before the update.
- If you are a US federal agency, apply the fix by 2026-05-03 to meet CISA's required deadline.
What happened
- 30 AprCISA added the WebPros cPanel and WHM and WP2 missing authentication vulnerability to its known-exploited catalog and set a 2026-05-03 federal fix deadline.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-41940 | WebPros cPanel and WHM Authentication Bypass via Login Flow | critical 9.3 | 30 Apr | 99% |
Our reporting
27 Octnpm worm that looked like a test secretly armed 42 GitHub repositories, researchers sayReported elsewhere
www.theregister.com - Articles · 26 OctWorm armed 42 GitHub repos by hiding a payload too big to fail ↗The records
support.cpanel.net: advisory ↗CISA known-exploited catalog ↗CVE-2026-41940 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works