THREATOPS

THREAT OPS › Threat News › [CISA KEV] CVE-2026-41940 — WebPros cPanel & WHM and WP2 (WordPress Squared): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

[CISA KEV] CVE-2026-41940 — WebPros cPanel & WHM and WP2 (WordPress Squared): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

lowcisa_kevPublished 2026-04-30

CVE: CVE-2026-41940 Vendor: WebPros Product: cPanel & WHM and WP2 (WordPress Squared) Vulnerability: WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability Date Added: 2026-04-30 Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations ar

MITRE ATT&CK techniques

Control PanelT1218.002
Cloud ServicesT1021.007

Indicators of compromise

CVE-2026-41940cve
https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026url
https://docs.cpanel.net/release-notes/release-notes/url
https://docs.wpsquared.com/changelogs/versions/changelog/#13617url

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-41940