CVE-2026-41940: WebPros cPanel & WHM authentication bypass in login flow

CVE-2026-41940 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2026-04-29

WebPros cPanel & WHM and WP2, which are widely used platforms for managing web hosting and WordPress sites, contain a critical security flaw in their login process. This vulnerability allows an unauthorized person to bypass security checks and gain full administrative control over the hosting panel without needing a password. This could lead to the complete takeover of websites, theft of customer data, or the deployment of ransomware across the server.

Technologies: WebPros cPanel. Vendors: WebPros.

Quick answers

Is CVE-2026-41940 exploited in the wild?
Yes. CVE-2026-41940 is known to be exploited in the wild, first recorded on 30 April 2026. Treat it as urgent.
How severe is CVE-2026-41940?
Critical severity, with a CVSS score of 9.8, published 29 April 2026.
Which products and versions are affected?
WebPros cPanel & WHM 11.40 through 136.0.4; WebPros WP2 Prior to 136.1.7.
Is there a fix for CVE-2026-41940?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-41940 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-41940?
Check whether you run WebPros cPanel, WebPros cPanel & WHM, WebPros WHM or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authentication vulnerability (CWE-306) exists in the login flow of cPanel & WHM and WP2. The flaw allows a remote, unauthenticated attacker to bypass the standard authentication mechanism and gain administrative access to the management interface. This vulnerability is being actively exploited in the wild, including in ransomware campaigns. Attackers can leverage this access to achieve remote code execution (RCE) on the underlying server. Patches have been released by the vendor, and users are urged to update to the latest versions immediately.

Affected products

  • WebPros cPanel & WHM 11.40 through 136.0.4
  • WebPros WP2 (WordPress Squared) Prior to 136.1.7

Timeline

  • 2026-04-28: advisory: Vendor security update released
  • 2026-04-30: disclosed: Public disclosure of CVE-2026-41940
  • 2026-04-30: kev added: Added to CISA Known Exploited Vulnerabilities catalog
  • 2026-04-30: exploited: Reported as mass-exploited in ransomware attacks

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.