Missing Authentication in WebPros cPanel & WHM & WP2 (WordPress Squared) Enables Unauthenticated Control‑Panel Access (CVE‑2026‑41940)
What It Is
A high‑severity authentication bypass exists in the login flow of WebPros cPanel & WHM and its WP2 (WordPress Squared) module. The flaw allows a remote attacker to reach the administrative control panel without presenting valid credentials, effectively granting full privileged access to the hosting environment.
Exploitability
The vulnerability is publicly listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. No public proof‑of‑concept is required; a simple crafted HTTP request to the login endpoint can bypass authentication. CVSS v3.1 base score is 8.8 (High).
Affected Products
- WebPros cPanel & WHM (WebHost Manager)
- WP2 (WordPress Squared) add‑on
Both components are bundled in many shared‑hosting and managed‑WordPress services.
Why It Matters for Compliance & Audit Readiness
Control‑centric frameworks (e.g., NIST CSF, ISO 27001) require evidence that privileged access is tightly managed and that vendor‑supplied software is kept free of known critical flaws. An unauthenticated entry point undermines access‑control and vendor‑management controls, exposing organizations to audit findings for:
- Failure to demonstrate due‑diligent patch management.
- Inadequate segregation of duties—any attacker can act as an administrator.
- Lack of verifiable logs showing who accessed the control panel.
Documenting remediation (patch applied, logs reviewed, controls re‑validated) provides a defensible audit trail and aligns with continuous control monitoring requirements.
Recommended Actions
- Patch Immediately – Deploy the vendor’s security update for CVE‑2026‑41940. Verify version numbers against the advisory.
- Validate Access Controls – Review authentication logs for any unauthorized logins since the last patch cycle.
- Enforce MFA – Enable multi‑factor authentication on all cPanel/WHM and WP2 admin accounts.
- Update Vendor‑Management Controls – Record the vulnerability in your vendor risk register, adjust risk scores, and require proof of remediation from the supplier.
- Document Evidence – Capture patch deployment records, log excerpts, and updated control mappings for audit readiness.
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-41940