WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Published 26 Sep 2026Updated 26 Sep 20261768 sources

CVSS 9.8 CRITICAL✓ VERIFIED REFERENCE△ CISA KEV

Overview Sources History

What happened

WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Affected versions

cPanel & WHM and WP2 (WordPress Squared): See original advisory Fixed: See vendor advisory.

Why it matters

This source correlation may provide earlier visibility while structured CVE metadata is still being updated.

Detection & mitigation

Review the original advisory and validate affected versions.
Apply vendor-provided updates or mitigations when available.

Public PoC references

RepositoryAuthorFirst seenReference

Exploit-DB 52574cPanel - CRLF Injectionnu11secur1ty2026-05-26Verified SploitusUnauthenticated root-level access in cPanel & WHM via CRLF injection in Authorization header.hitechcloud-vietnam2026-09-26T17:19:48Verified CVE-Intel · Kagantua/cPanelWHM-AuthBypassCVE-2026-41940BypassCRITICALAnalyzed★ 11⑂ 7EPSS 98.53%CVE data: CNAUpdated 26 Aug 2026Kagantua2026-04-30Candidate CVE-Intel · ynsmroztas/cPanelSniperCVE-2026-41940 — cPanel & WHM Authentication Bypass via Session-File CRLF InjectionInjectionPythonCRITICALAnalyzed★ 494⑂ 137EPSS 98.53%CVE data: CNACode indexedUpdated 25 Aug 2026ynsmroztas2026-05-01Candidate CVE-Intel · lanicer/cve-2026-41940-PoCA cPanel and WHM authentication bypassing toolBypassPythonCRITICALAnalyzed★ 529⑂ 96EPSS 98.53%CVE data: CNACode indexedUpdated 25 Aug 2026Tags: cpanel, cve, cve-2026-41940, cve-scanning, vulnerability-researchlanicer2026-08-19Candidate CVE-Intel · Defacto-ridgepole254/CVE-2026-41940-Exploit-PoCTest authentication bypass vulnerabilities in cPanel and WHM using this proof of concept exploit tool written in Go.BypassCRITICALAnalyzed★ 1⑂ 2EPSS 98.53%CVE data: CNAUpdated 25 Aug 2026Tags: authentication-bypass, cpanel, cpanel-exploit, cve, cve-2026-41940, cve-exploit, exploit, pocDefacto-ridgepole2542026-05-06Candidate CVE-Intel · t4xo/CVE-2026-41940ts zeroday exp made by nullsec white teamZero-DayPythonCRITICALAnalyzed★ 0⑂ 0EPSS 98.53%CVE data: CNACode indexedUpdated 22 Aug 2026t4xo2026-08-22Candidate CVE-Intel · XsanFlip/poc-cpanel-cve-2026-41940PoCPythonCRITICALAnalyzed★ 64⑂ 11EPSS 98.53%CVE data: CNACode indexedUpdated 20 Aug 2026XsanFlip2026-05-01Candidate CVE-Intel · ilmndwntr/CVE-2026-41940-MASS-EXPLOITCVE-2026-41940 SUPPORT SINGLE & MASS SCAN EXPLOITExploitPythonCRITICALAnalyzed★ 14⑂ 9EPSS 98.53%CVE data: CNACode indexedUpdated 19 Aug 2026ilmndwntr2026-04-30Candidate CVE-Intel · murrez/CVE-2026-41940PoC for CVE-2026-41940: WHM/cPanel authentication bypass chain (Python 2.7). For authorized security research and testing only.BypassPythonCRITICALAnalyzed★ 5⑂ 1EPSS 98.53%CVE data: CNACode indexedUpdated 18 Aug 2026murrez2026-05-06Candidate hitechcloud-vietnam/cve-2026-41940-PoCUnauthenticated root-level access in cPanel & WHM via CRLF injection in Authorization header.hitechcloud-vietnam2026-09-26T17:19:48Verified SploitusProof-of-concept exploit for CVE-2026-41940. CVSS 9.8.Sploitus index2026-10-11T07:54:18+00:00Candidate

Corrections Report an issue