Authentication Bypass in WebPros cPanel & WHM and WP2

Historical catalog analysis: CISA added this entry on April 30, 2026. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-41940 is an authentication bypass vulnerability (CWE-306) identified in WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared). The flaw exists within the login flow, allowing a remote attacker to bypass authentication requirements and gain unauthorized access to the control panel without valid credentials.

Exposure and applicability

This vulnerability affects organizations utilizing WebPros cPanel & WHM or WP2 for server and hosting management. Because these tools typically manage critical infrastructure and multiple user accounts, an unauthenticated bypass provides a high-privilege entry point into the environment. The risk is elevated by reports that this specific vulnerability has been utilized in known ransomware campaigns.

Remediation priorities

Based on the reported exploitation by ransomware actors, remediation should be prioritized for all internet-facing instances of these products. Our analysis suggests the following priority sequence:

1. Immediate Patching: Apply vendor-supplied mitigations and updates as detailed in WebPros security advisories. This is the primary method to eliminate the authentication bypass.
2. Cloud Service Review: For organizations utilizing these tools via cloud providers, follow BOD 22-01 guidance to ensure that service providers have applied necessary updates to the underlying infrastructure.
3. Product Decommissioning: In scenarios where mitigations are unavailable or cannot be verified, discontinue use of the affected product to remove the exposure path.

How to validate remediation

Verification must move beyond simple version checks, as a deployed update does not always guarantee that the vulnerability is neutralized in a specific environment. To verify that exposure has been reduced, defenders should:

• Confirm Update Application: Verify through vendor-provided release notes and system logs that the specific security updates addressing CVE-2026-41940 are active.
• Authentication Testing: Conduct authorized testing to ensure that the login flow no longer permits access without valid credentials. This should be performed in a controlled manner to confirm the bypass is closed.
• Access Log Audit: Review authentication logs for evidence of unauthorized access attempts or successful logins originating from unexpected sources prior to and after patching.

Limits and open questions

While applying vendor updates addresses the known bypass, residual risk remains if attackers gained persistence during the window of exposure. Patching prevents new unauthenticated entries but does not remove existing unauthorized accounts or backdoors created via previous exploitation. It remains unknown exactly which versions are affected without referencing specific vendor release notes for each product line.

Source and editorial note

CVE-2026-41940: WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability · Source date: April 30, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: May 03, 2026. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 02, 2026 at 00:40 UTC.

Request a Vulnerability Assessment