CVE-2026-41940
WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability
Description
CVE-2026-41940 is a CRITICAL severity authentication bypass vulnerability in WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared), with a CVSS 3.1 score of 9.8. The flaw lives in the login flow and allows an unauthenticated remote attacker to gain access to the control panel without valid credentials, yielding full administrative access to all hosted websites, mailboxes, databases, and backups. Affected versions span the entire post-11.40 cPanel/WHM range and WP Squared prior to 136.1.7. Public exploit code is available from watchTowr Labs ("watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py"), and Namecheap publicly disclosed an ongoing critical security incident driven by this vulnerability on April 28, 2026. CISA added CVE-2026-41940 to the KEV catalog on April 30, 2026, with an extremely aggressive remediation deadline of May 3, 2026. The EPSS score of 0.284 (96.5th percentile) reflects high active exploitation pressure.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cpanel | cpanel | >= 11.40, < 86.0.41; >= 88.0.0, < 110.0.97; >= 112.0.0, < 118.0.63; >= 120.0.0, < 124.0.35; >= 126.0.1, < 126.0.54; >= 128.0.0, < 130.0.19; >= 132.0.0, < 132.0.29; >= 134.0.0, < 134.0.20; >= 136.0.0, < 136.0.5 |
| cpanel | whm | >= 11.40, < 86.0.41; >= 88.0.0, < 110.0.97; >= 112.0.0, < 118.0.63; >= 120.0.0, < 124.0.35; >= 126.0.1, < 126.0.54; >= 128.0.0, < 130.0.19; >= 132.0.0, < 132.0.29; >= 134.0.0, < 134.0.20; >= 136.0.0, < 136.0.5 |
| cpanel | wp squared | < 136.1.7 |
References
- https://docs.cpanel.net/release-notes/release-notes(Release Notes)
- https://docs.wpsquared.com/changelogs/versions/changelog/#13617(Release Notes)
- https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026(Vendor Advisory)
- https://www.namecheap.com/status-updates/ongoing-critical-security-vulnerability-in-cpanel-april-28-2026(Third Party Advisory)
- https://www.vulncheck.com/advisories/cpanel-and-whm-authentication-bypass-via-login-flow(Third Party Advisory)
- https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/(Exploit, Third Party Advisory)
- https://www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks/(Press/Media Coverage)
- https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41940(US Government Resource)
Weakness Type
CWE-306: Missing Authentication for Critical Function
Missing Authentication for Critical Function occurs when software does not perform any authentication for functionality that requires a provable user identity or consumes significant resources — this is not a case of weak authentication, it is the complete absence of an authentication check on a critical operation. In cPanel & WHM and WP Squared, the vulnerable login flow exposes a code path that should require valid credentials but instead returns an authenticated session without verifying the caller's identity. An unauthenticated remote attacker can drive this code path to obtain a session cookie or token equivalent to the cPanel/WHM administrator, bypassing the login form entirely. From there, all administrative functionality of cPanel & WHM is reachable with no further authentication challenge.
Learn more: CWE-306 — Missing Authentication for Critical Function
Impact Analysis
CVE-2026-41940 carries a CVSS 3.1 score of 9.8 (CRITICAL) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — the most severe non-Scope:Changed configuration: network attack vector, low complexity, no privileges required, no user interaction, and uniformly High impact across Confidentiality, Integrity, and Availability. cPanel & WHM is one of the most widely deployed web-hosting control panels in the world, used by tens of thousands of shared-hosting providers and enterprise hosting platforms; any compromised server typically holds dozens to hundreds of customer websites, mail accounts, MySQL/MariaDB databases, FTP/SSH credentials, and backup archives. Successful exploitation grants the attacker full administrative control over every tenant on a compromised server, enabling website defacement, mass credential harvesting, malware injection into customer WordPress and PHP sites (especially severe given the WP Squared product line is also vulnerable), and downstream supply-chain compromise via injected JavaScript or modified plugin/theme code. Namecheap's public status update describing an "ongoing critical security vulnerability in cPanel" indicates that a major hosting provider was already responding to active exploitation at disclosure time.
Exploit Maturity
Public Exploits: A weaponized exploit converting the authentication bypass into remote code execution is available from watchTowr Labs at github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py. VulnCheck has published an advisory at vulncheck.com/advisories/cpanel-and-whm-authentication-bypass-via-login-flow with technical detail. Active Exploitation: CISA added CVE-2026-41940 to the KEV catalog on April 30, 2026, with a remediation deadline of May 3, 2026 — a three-day window that signals exceptional urgency. Hosting provider Namecheap publicly disclosed an ongoing critical security incident driven by this vulnerability on April 28, 2026, demonstrating real-world exploitation against production hosting infrastructure. CISA has subsequently updated the KEV catalog entry to flag CVE-2026-41940 as actively used in ransomware campaigns, escalating the exploitation context from opportunistic compromise to targeted post-access extortion against compromised hosting servers and their downstream tenant websites. Exploitation Probability: With an EPSS score of 0.284 (96.5th percentile), the model rates the probability of continued widespread exploitation as very high. Practical Risk: cPanel/WHM servers are continuously scanned at internet scale by opportunistic threat actors, and the unauthenticated, low-complexity nature of CVE-2026-41940 means any unpatched cPanel/WHM or WP Squared instance reachable on port 2083/2087 should be considered imminently at risk of compromise — if not already compromised.
Remediation
- Apply the cPanel/WHM and WP Squared security update immediately. WebPros has published the cPanel & WHM Security Update of April 28, 2026, with patched releases across all supported branches: cPanel/WHM 86.0.41, 110.0.97, 118.0.63, 126.0.54, 130.0.19, 132.0.29, 134.0.20, and 136.0.5. WP Squared is fixed in 136.1.7. Confirm post-update that the running version reflects the patched release on every host.
- Force a password and key rotation across the entire control panel. Because the bypass yields administrator access, any credentials, API tokens, SSH keys, FTP accounts, or session cookies handled by the cPanel/WHM server must be considered exposed. Reset administrator and customer passwords, regenerate API tokens, rotate SSH keys for any account reachable through cPanel, and force log-out of all sessions.
- Hunt for compromise. Inspect cPanel and WHM access/authentication logs (
/usr/local/cpanel/logs/access_log,error_log,login_log) for unusual successful authentications without a preceding failed attempt, sessions originating from unfamiliar IP ranges, and creation of new admin accounts or reseller accounts since April 28, 2026. Audit hosted websites — particularly WordPress installations — for newly added admin users, modified.htaccessfiles, injected PHP backdoors, and unexpected scheduled tasks. - Restrict management interfaces. While patching is the primary remediation, reduce attack surface by restricting cPanel/WHM management ports (2082, 2083, 2086, 2087) to known administrator IP ranges via firewall or cPHulk Brute Force Protection, and place infrastructure-management consoles behind a VPN.
- Long-term hardening. Apply the CWE-306 mitigation principle — every privileged endpoint must enforce authentication explicitly, never rely on implicit assumptions about reachability or routing. Operationally: enable two-factor authentication for all cPanel/WHM administrator accounts, deploy Web Application Firewall coverage in front of the management interface, and treat any future cPanel/WHM advisory with an emergency patch SLA of under 72 hours given the high attacker pressure on this software.
Technical Details
CVE-2026-41940 is a CWE-306 missing-authentication-for-critical-function flaw in the login flow of WebPros cPanel & WHM and WP Squared (WordPress Squared). The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms that the issue is reachable purely over the network with low complexity, no privileges, and no user interaction — making it a textbook unauthenticated pre-auth RCE-class issue once chained with cPanel's normal post-login functionality. The watchTowr Labs proof-of-concept ("watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py") demonstrates that the auth bypass can be directly converted into remote code execution by leveraging cPanel's standard administrative tools after the bypass yields a privileged session. The affected version range is unusually broad — every cPanel/WHM release after version 11.40 is in scope, with patched builds in eight separate maintenance branches (86, 110, 118, 126, 130, 132, 134, 136) — indicating the defective code path has been carried across long-lived major branches. WP Squared, which packages WordPress hosting on top of the cPanel core, is fixed in 136.1.7. Because cPanel typically runs as a privileged daemon and orchestrates hosting accounts that own multiple websites and mailboxes, the practical effect of unauthenticated control-panel access is full host and tenant compromise.
Frequently Asked Questions
Is CVE-2026-41940 being actively exploited?
Yes. CISA added CVE-2026-41940 to the KEV catalog on April 30, 2026, with an extraordinarily short three-day remediation deadline of May 3, 2026. Hosting provider Namecheap publicly disclosed an active security incident driven by this vulnerability on April 28, 2026, and watchTowr Labs has released a working auth-bypass-to-RCE exploit. The EPSS score of 0.284 (96.5th percentile) reflects very high continued exploitation pressure.
What products are affected by CVE-2026-41940?
cPanel and WHM versions after 11.40 are vulnerable across all supported maintenance branches. Patched builds: 86.0.41, 110.0.97, 118.0.63, 126.0.54, 130.0.19, 132.0.29, 134.0.20, 136.0.5. WP Squared (WordPress Squared) prior to 136.1.7 is also affected and patched in 136.1.7.
How do I fix CVE-2026-41940?
Apply the WebPros security update of April 28, 2026 immediately, then rotate every credential, API token, and SSH key handled by the cPanel/WHM server (administrator passwords, customer passwords, API keys), force log-out of all sessions, and audit cPanel/WHM logs and hosted-website artifacts for indicators of compromise. Restrict cPanel/WHM management ports to known administrative IP ranges as a defense-in-depth measure.
How severe is CVE-2026-41940?
CVE-2026-41940 is rated CRITICAL (CVSS 3.1 score 9.8) with full High impact on Confidentiality, Integrity, and Availability and no authentication or user interaction required. Combined with KEV listing, a three-day CISA remediation deadline, public exploit code, and confirmed exploitation against a major hosting provider, it is one of the most urgent vulnerabilities in the April 2026 advisory cycle.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.