Read the docs
TI-2026-30342 Aliases CVE-2026-41940GHSA-85qr-8rxc-62gv

WebPros cPanel and WHM Authentication Bypass via Login Flow

Priority CRITICAL 99Exploited in the wildCWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Why it matters now

Exploitation Active In CISA KEV since 2026-04-30CISA due date 2026-05-03Known ransomware use
EPSS 0.98527 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed cPanel (WebPros): 11.86.0.41, 11.94.0.28, 11.102.0.39 +8WP Squared (WebPros): 11.136.1.7+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WebProscPanel11.40.0.0 to before 11.86.0.41; 11.88.0.0 to before 11.94.0.28; 11.96.0.0 to before 11.102.0.39; 11.104.0.0 to before 11.110.0.97; 11.112.0.0 to before 11.118.0.63; 11.120.0.0 to before 11.124.0.35; 11.126.0.0 to before 11.126.0.54; 11.128.0.0 to before 11.130.0.19; 11.132.0.0 to before 11.132.0.29; 11.134.0.0 to before 11.134.0.20; 11.136.0.0 to before 11.136.0.511.86.0.41, 11.94.0.28, 11.102.0.39, 11.110.0.97, 11.118.0.63, 11.124.0.35, 11.126.0.54, 11.130.0.19, 11.132.0.29, 11.134.0.20, 11.136.0.5Patch availableCNA
WebProsWP Squaredbefore 11.136.1.711.136.1.7Patch availableCNA
WebProsWHM11.40.0.0 to before 11.86.0.41; 11.88.0.0 to before 11.94.0.28; 11.96.0.0 to before 11.102.0.39; 11.104.0.0 to before 11.110.0.97; 11.112.0.0 to before 11.118.0.63; 11.120.0.0 to before 11.124.0.35; 11.126.0.0 to before 11.126.0.54; 11.128.0.0 to before 11.130.0.19; 11.132.0.0 to before 11.132.0.29; 11.134.0.0 to before 11.134.0.20; 11.136.0.0 to before 11.136.0.511.86.0.41, 11.94.0.28, 11.102.0.39, 11.110.0.97, 11.118.0.63, 11.124.0.35, 11.126.0.54, 11.130.0.19, 11.132.0.29, 11.134.0.20, 11.136.0.5Patch availableCNA
  • cPanel VendorWebPros Affected 11.40.0.0 to before 11.86.0.41; 11.88.0.0 to before 11.94.0.28; 11.96.0.0 to before 11.102.0.39; 11.104.0.0 to before 11.110.0.97; 11.112.0.0 to before 11.118.0.63; 11.120.0.0 to before 11.124.0.35; 11.126.0.0 to before 11.126.0.54; 11.128.0.0 to before 11.130.0.19; 11.132.0.0 to before 11.132.0.29; 11.134.0.0 to before 11.134.0.20; 11.136.0.0 to before 11.136.0.5 Fixed in 11.86.0.41, 11.94.0.28, 11.102.0.39, 11.110.0.97, 11.118.0.63, 11.124.0.35, 11.126.0.54, 11.130.0.19, 11.132.0.29, 11.134.0.20, 11.136.0.5 Patch available CNA
  • WP Squared VendorWebPros Affected before 11.136.1.7 Fixed in 11.136.1.7 Patch available CNA
  • WHM VendorWebPros Affected 11.40.0.0 to before 11.86.0.41; 11.88.0.0 to before 11.94.0.28; 11.96.0.0 to before 11.102.0.39; 11.104.0.0 to before 11.110.0.97; 11.112.0.0 to before 11.118.0.63; 11.120.0.0 to before 11.124.0.35; 11.126.0.0 to before 11.126.0.54; 11.128.0.0 to before 11.130.0.19; 11.132.0.0 to before 11.132.0.29; 11.134.0.0 to before 11.134.0.20; 11.136.0.0 to before 11.136.0.5 Fixed in 11.86.0.41, 11.94.0.28, 11.102.0.39, 11.110.0.97, 11.118.0.63, 11.124.0.35, 11.126.0.54, 11.130.0.19, 11.132.0.29, 11.134.0.20, 11.136.0.5 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*11.40 to before 86.0.41; 88.0.0 to before 110.0.97; 112.0.0 to before 118.0.63; 120.0.0 to before 124.0.35; 126.0.1 to before 126.0.54; 128.0.0 to before 130.0.19; 132.0.0 to before 132.0.29; 134.0.0 to before 134.0.20; 136.0.0 to before 136.0.5VulnerableCpanel
cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:*11.40 to before 86.0.41; 88.0.0 to before 110.0.97; 112.0.0 to before 118.0.63; 120.0.0 to before 124.0.35; 126.0.1 to before 126.0.54; 128.0.0 to before 130.0.19; 132.0.0 to before 132.0.29; 134.0.0 to before 134.0.20; 136.0.0 to before 136.0.5VulnerableCpanel
cpe:2.3:a:cpanel:wp_squared:*:*:*:*:*:wordpress:*:*before 136.1.7VulnerableCpanel
  • cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:* Versions 11.40 to before 86.0.41; 88.0.0 to before 110.0.97; 112.0.0 to before 118.0.63; 120.0.0 to before 124.0.35; 126.0.1 to before 126.0.54; 128.0.0 to before 130.0.19; 132.0.0 to before 132.0.29; 134.0.0 to before 134.0.20; 136.0.0 to before 136.0.5 Vulnerable ·Cpanel
  • cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:* Versions 11.40 to before 86.0.41; 88.0.0 to before 110.0.97; 112.0.0 to before 118.0.63; 120.0.0 to before 124.0.35; 126.0.1 to before 126.0.54; 128.0.0 to before 130.0.19; 132.0.0 to before 132.0.29; 134.0.0 to before 134.0.20; 136.0.0 to before 136.0.5 Vulnerable ·Cpanel
  • cpe:2.3:a:cpanel:wp_squared:*:*:*:*:*:wordpress:*:* Versions before 136.1.7 Vulnerable ·Cpanel

Remediation

  • Fix · CNA cPanel (WebPros) Fixed in 11.86.0.41, 11.94.0.28, 11.102.0.39, 11.110.0.97, 11.118.0.63, 11.124.0.35, 11.126.0.54, 11.130.0.19, 11.132.0.29, 11.134.0.20, 11.136.0.5
  • Fix · CNA WP Squared (WebPros) Fixed in 11.136.1.7
  • Fix · CNA WHM (WebPros) Fixed in 11.86.0.41, 11.94.0.28, 11.102.0.39, 11.110.0.97, 11.118.0.63, 11.124.0.35, 11.126.0.54, 11.130.0.19, 11.132.0.29, 11.134.0.20, 11.136.0.5

Timeline

  1. 2026-04-30 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2026-41940
  3. 2026-10-03 Alias added: GHSA-85qr-8rxc-62gv

References

Exploit 2

Patch 1

Advisory 1

Other 2

  • TI-2026-46792 Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root. CVSS 4.0HIGH 8.7
  • TI-2025-40383 Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS)… CVSS 3.1HIGH 7.5
  • TI-2026-23322 Incorrect privileges management and insufficient path filtering allow to read arbitrary… CVSS 3.1HIGH 8.6
  • TI-2026-47685 Deserialization of untrusted data in WebPros WHMCS CVSS 4.0CRITICAL 9.3
  • TI-2026-23317 Authorization bypass in WebPros Comet Backup CVSS 4.0CRITICAL 9.9
  • TI-2026-47687 An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI… CVSS 4.0CRITICAL 9.2
See all 50 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences