Missing-Authentication Bypass in WebPros cPanel & WHM (AuthBypass to RCE)
CISA: WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability
CVSS 4.0
9.3critical
EPSS
99%p100
Published
()
KEV added
AI analysis
CVE-2026-41940 is a critical missing-authentication flaw (CWE-306) in the login flow of WebPros cPanel & WHM (versions after 11.40) and WP2 (WordPress Squared) that lets unauthenticated remote attackers bypass authentication and gain unauthorized access to the control panel. Because no privileges, user interaction, or special conditions are required, any attacker who can reach the login endpoint over the network can attempt it. Beyond control-panel account takeover, public proofs of concept — including watchTowr's 'AuthBypass to RCE' exploit — show the flaw can be chained to remote code execution, and reporting indicates a single hosting customer could obtain root control of an entire shared server. Any hosting provider, MSP, reseller, or organization running cPanel/WHM or WP Squared is affected; cPanel is the dominant commercial hosting control panel, implying a very large installed base of shared-hosting servers and hosted domains. Exploitation is confirmed in the wild: CISA added it to the KEV on 2026-04-30 with known ransomware use, EPSS assigns a 98.5% probability of exploitation within 30 days (100th percentile), and multiple threat actors are actively exploiting it, including against government and MSP networks.
What to do: Patch immediately per WebPros' advisory — the source data does not specify fixed version numbers, so follow vendor instructions for exact patched releases; CISA KEV/BOD 22-01 requires federal agencies to apply mitigations or discontinue use by the stated deadline (reported as Sunday). Until patched, restrict access to the cPanel/WHM login interface (IP allowlisting, VPN, or limiting management-interface exposure) and hunt for indicators of compromise such as unexpected control-panel logins, new admin accounts, webshells, or ransomware artifacts. The referenced public PoCs can be used to validate whether your instances are exploitable.
Affected
WebPros cPanel
versions after 11.40 (per CISA description)
WebPros WHM
versions after 11.40 (per CISA description)
WebPros WP2 (WordPress Squared)
—
Estimated exposure
mass≈100,000+ internet-exposed cPanel/WHM servers, spanning tens of millions of hosted domains and millions of end users — Estimated from cPanel & WHM's position as the dominant commercial hosting control panel, deployed across hundreds of thousands of shared-hosting servers and powering tens of millions of domains, with public internet scans of cPanel login…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
CISA Known Exploited Vulnerability
Affected
WebPros cPanel & WHM and WP2 (WordPress Squared)
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
cPanel patched critical flaw CVE-2026-65643 letting authenticated hosting customers with addon or parked domain rights execute code as root and fully compromise servers.
cPanel issued patches on August 27, 2026 for CVE-2026-65643, a flaw in domain parking and addon domain functionality in cPanel & WHM that lets an authenticated account holder create arbitrary files and execute code as root, yielding full server control. Fixed builds cover the 11.110, 11.134, 11.136 and 11.138 branches, including WP Squared 11.138.1.7, and auto-update servers receive the fix automatically. No CVSS score, published CVE record, or evidence of exploitation has appeared, and the flaw is absent from CISA's KEV catalog as of August 27. The article also recaps related 2026 cPanel-ecosystem issues, including KEV-listed LiteSpeed plugin flaws and the in-the-wild-exploited Phusion Passenger problem.