CVE-2026-41940 WebPros CPanel

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

CVSS: 9.3 Critical
EPSS: 99%
Percentile: 100
Published: 2026-04-29
Force: 11 of 12
Public PoC: 71

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE-306

On CISA’s exploited list

WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

Added: 2026-04-30
Federal patch deadline: 2026-05-03
Ransomware use: known

NVD CVE.org All exploited vulnerabilities