WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

WebPros cPanel & WHM and WP2 (WordPress Squared)

WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. Added to CISA KEV on 2026-04-30 (federal deadline 2026-05-03).

First seen: 30 Apr 2026
Last update: 30 Apr 2026, 12:00 UTC
Identifiers: CVE-2026-41940
Source: CISA KEV
On the menu as: WordPress

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability
Severity: critical, exploited in the wild. Patch status: patched.
Affected: WebPros cPanel & WHM and WP2 (WordPress Squared)
Ids: CVE-2026-41940

WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. Added to CISA KEV on 2026-04-30 (federal deadline 2026-05-03).

## Steps
1. Search the repo, its CI and infra config for WebPros cPanel & WHM and WP2 (WordPress Squared). If present, report the version in use and whether it's affected.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-41940") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://docs.cpanel.net/release-notes/release-notes/ https://docs.wpsquared.com/changelogs/versions/changelog/#13617 https://nvd.nist.gov/vuln/detail/CVE-2026-41940 https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026
https://pwned.coffee/i/webpros-cpanel-whm-and-wp2-wordpress-squared-missing-aut-cve-2026-41940

Sources

Totalone very hot coffee