CISA Known Exploited Vulnerability

CVE-2026-41940

WebPros · cPanel & WHM and WP2 (WordPress Squared)

WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

Date added 2026-04-30

BOD 22-01 due date 2026-05-03

CWE CWE-306

Ransomware Unknown

CISA description

WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes & references

https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026
https://docs.cpanel.net/release-notes/release-notes/
https://docs.wpsquared.com/changelogs/versions/changelog/#13617
https://nvd.nist.gov/vuln/detail/CVE-2026-41940

Where this lands in 800-53

Vulnerability data triggers these controls during assessment and continuous monitoring.

RA-5 · Vulnerability Monitoring and Scanning
SI-2 · Flaw Remediation
CM-6 · Configuration Settings
SI-7 · Software, Firmware, and Information Integrity
CM-8 · System Component Inventory

External lookups

NVD · CVE-2026-41940
CVE.org · CVE-2026-41940
CISA KEV catalog (canonical)