{"schema":"threatline.record/2","record":{"id":"CVE-2026-41940","aliases":[],"summary":"WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability","details":"WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.","categories":["Applications & CMS"],"product":"cPanel & WHM and WP2 (WordPress Squared)","vendor":"WebPros","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-41940","source_modified_at":"2026-09-30T17:20:17.713Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"cPanel","vendor":"WebPros","versions":[{"status":"affected","version":"11.40.0.0","versionType":"custom","lessThan":"11.86.0.41"},{"status":"affected","version":"11.88.0.0","versionType":"custom","lessThan":"11.94.0.28"},{"status":"affected","version":"11.96.0.0","versionType":"custom","lessThan":"11.102.0.39"},{"status":"affected","version":"11.104.0.0","versionType":"custom","lessThan":"11.110.0.97"},{"status":"affected","version":"11.112.0.0","versionType":"custom","lessThan":"11.118.0.63"},{"status":"affected","version":"11.120.0.0","versionType":"custom","lessThan":"11.124.0.35"},{"status":"affected","version":"11.126.0.0","versionType":"custom","lessThan":"11.126.0.54"},{"status":"affected","version":"11.128.0.0","versionType":"custom","lessThan":"11.130.0.19"},{"status":"affected","version":"11.132.0.0","versionType":"custom","lessThan":"11.132.0.29"},{"status":"affected","version":"11.134.0.0","versionType":"custom","lessThan":"11.134.0.20"},{"status":"affected","version":"11.136.0.0","versionType":"custom","lessThan":"11.136.0.5"}],"defaultStatus":"affected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-41940","source_modified_at":"2026-09-30T17:20:17.713Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"WP Squared","vendor":"WebPros","versions":[{"status":"affected","version":"0","versionType":"custom","lessThan":"11.136.1.7"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-41940","source_modified_at":"2026-09-30T17:20:17.713Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"WHM","vendor":"WebPros","versions":[{"status":"affected","version":"11.40.0.0","versionType":"custom","lessThan":"11.86.0.41"},{"status":"affected","version":"11.88.0.0","versionType":"custom","lessThan":"11.94.0.28"},{"status":"affected","version":"11.96.0.0","versionType":"custom","lessThan":"11.102.0.39"},{"status":"affected","version":"11.104.0.0","versionType":"custom","lessThan":"11.110.0.97"},{"status":"affected","version":"11.112.0.0","versionType":"custom","lessThan":"11.118.0.63"},{"status":"affected","version":"11.120.0.0","versionType":"custom","lessThan":"11.124.0.35"},{"status":"affected","version":"11.126.0.0","versionType":"custom","lessThan":"11.126.0.54"},{"status":"affected","version":"11.128.0.0","versionType":"custom","lessThan":"11.130.0.19"},{"status":"affected","version":"11.132.0.0","versionType":"custom","lessThan":"11.132.0.29"},{"status":"affected","version":"11.134.0.0","versionType":"custom","lessThan":"11.134.0.20"},{"status":"affected","version":"11.136.0.0","versionType":"custom","lessThan":"11.136.0.5"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-41940","source_modified_at":"2026-09-30T17:20:17.713Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"cPanel","ecosystem":null},"version":"11.86.0.41","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-41940","source_modified_at":"2026-09-30T17:20:17.713Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"cPanel","ecosystem":null},"version":"11.94.0.28","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-41940","source_modified_at":"2026-09-30T17:20:17.713Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"cPanel","ecosystem":null},"version":"11.102.0.39","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-41940","source_modified_at":"2026-09-30T17:20:17.713Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"cPanel","ecosystem":null},"version":"11.110.0.97","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-41940","source_modified_at":"2026-09-30T17:20:17.713Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"cPanel","ecosystem":null},"version":"11.118.0.63","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-41940","source_modified_at":"2026-09-30T17:20:17.713Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"cPanel","ecosystem":null},"version":"11.124.0.35","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-41940","source_modified_at":"2026-09-30T17:20:17.713Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"cPanel","ecosystem":null},"version":"11.126.0.54","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-41940","source_modified_at":"2026-09-30T17:20:17.713Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"cPanel","ecosystem":null},"version":"11.130.0.19","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-41940","source_modified_at":"2026-09-30T17:20:17.713Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"cPanel","ecosystem":null},"version":"11.132.0.29","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-41940","source_modified_at":"2026-09-30T17:20:17.713Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"cPanel","ecosystem":null},"version":"11.134.0.20","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-41940","source_modified_at":"2026-09-30T17:20:17.713Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"cPanel","ecosystem":null},"version":"11.136.0.5","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-41940","source_modified_at":"2026-09-30T17:20:17.713Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"WP Squared","ecosystem":null},"version":"11.136.1.7","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-41940","source_modified_at":"2026-09-30T17:20:17.713Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"WHM","ecosystem":null},"version":"11.86.0.41","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-41940","source_modified_at":"2026-09-30T17:20:17.713Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"WHM","ecosystem":null},"version":"11.94.0.28","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-41940","source_modified_at":"2026-09-30T17:20:17.713Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"WHM","ecosystem":null},"version":"11.102.0.39","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-41940","source_modified_at":"2026-09-30T17:20:17.713Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"WHM","ecosystem":null},"version":"11.110.0.97","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-41940","source_modified_at":"2026-09-30T17:20:17.713Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"WHM","ecosystem":null},"version":"11.118.0.63","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-41940","source_modified_at":"2026-09-30T17:20:17.713Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"WHM","ecosystem":null},"version":"11.124.0.35","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-41940","source_modified_at":"2026-09-30T17:20:17.713Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"WHM","ecosystem":null},"version":"11.126.0.54","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-41940","source_modified_at":"2026-09-30T17:20:17.713Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"WHM","ecosystem":null},"version":"11.130.0.19","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-41940","source_modified_at":"2026-09-30T17:20:17.713Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"WHM","ecosystem":null},"version":"11.132.0.29","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-41940","source_modified_at":"2026-09-30T17:20:17.713Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"WHM","ecosystem":null},"version":"11.134.0.20","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-41940","source_modified_at":"2026-09-30T17:20:17.713Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"WHM","ecosystem":null},"version":"11.136.0.5","basis":"first unaffected version stated in the CVE record"}],"cvss":9.3,"severity":"Critical","kev":{"listed":true,"date_added":"2026-04-30","due_date":"2026-05-03","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware_campaign_use":"Known"},"epss":{"probability":0.98527,"percentile":0.99922,"score_date":"2026-10-23"},"published_at":"2026-04-29T15:10:37.899Z","modified_at":"2026-09-30T17:20:17.713Z","provenance":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T17:00:09.9001Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-41940","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-30T17:20:17.713Z"},{"source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-04-28"},{"source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/52574","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-05-26"},{"source":"Nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41940.yaml","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":null},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-41940","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CISA KEV","CVE List","Metasploit","Exploit-DB","Nuclei","EPSS"],"references":[{"source":"CVE List","url":"https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026","tags":["vendor-advisory","patch"]},{"url":"https://docs.cpanel.net/release-notes/release-notes/","source":"CISA KEV"},{"source":"CVE List","url":"https://docs.wpsquared.com/changelogs/versions/changelog/#13617","tags":["release-notes"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41940\"","source":"CISA KEV"},{"source":"CVE List","url":"https://docs.cpanel.net/release-notes/release-notes","tags":["release-notes"]},{"source":"CVE List","url":"https://www.namecheap.com/status-updates/ongoing-critical-security-vulnerability-in-cpanel-april-28-2026","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/cpanel-and-whm-authentication-bypass-via-login-flow","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py","tags":["exploit"]},{"source":"CVE List","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41940","tags":["government-resource"]},{"source":"CVE List","url":"https://www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks/"},{"source":"CVE List","url":"https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"active","automatable":"yes","technical_impact":"total","assessed_at":"2026-04-29T00:00:00+00:00"},"exploits":[{"source":"Metasploit","kind":"Exploit module","name":"cPanel/WHM CRLF Injection Authentication Bypass RCE","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb","date":"2026-04-28","added":"2026-06-02","check":true},{"source":"Exploit-DB","kind":"Webapps exploit","name":"cPanel - CRLF Injection","url":"https://www.exploit-db.com/exploits/52574","date":"2026-05-26","added":"2026-05-26","verified":false},{"source":"Nuclei","kind":"Scanner template","name":"cPanel & WHM - Authentication Bypass via Session-File CRLF Injection","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41940.yaml"}],"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-30T17:20:17.713Z","content_hash":"1388ec4ae00cebd3a749f41c0b74df6335fc57dfac6de2c8d898a80bdfd33c1f"}}