H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Vulnerability

CVE-2026-41940

WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Vulnerability
TypeVulnerability
External ID—
First seen2026-04-30
Last seen2026-04-30

Confidence

—

WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Labels

exploitedkevransomware

CISA KEV context

Vendor / productWebPros cPanel & WHM and WP2 (WordPress Squared)
Added2026-04-30
Due date2026-05-03
6 recorded

Relationships

mitigates
from Remediate CVE-2026-41940
Mitigation
related-to
to Choosing Message Identifier
Technique
related-to
to Communication Channel Manipulation
Technique
related-to
to Cross Site Request Forgery
Technique
related-to
to Force the System to Reset Values
Technique
related-to
to Using Unpublished Interfaces or Functionality
Technique
2 external

References

nvd
CVE-2026-41940
open
cwe
CWE-306
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance