WordPress · Wp Squared · CVE-2026-41940
**Name of the Vulnerable Software and Affected Versions**
cPanel and WHM versions prior to 11.110.0.97
cPanel and WHM versions prior to 11.118.0.63
cPanel and WHM versions prior to 11.126.0.54
cPanel and WHM versions prior to 11.132.0.29
cPanel and WHM versions prior to 11.134.0.20
cPanel and WHM versions prior to 11.136.0.5
WP Squared versions prior to 136.1.7
**Description**
A critical authentication bypass exists in the pre-authentication session logic of the `cpsrvd` service daemon. The issue stems from improper sanitization of the `Authorization` header, allowing a Carriage Return Line Feed (CRLF) injection—a technique where special characters (`r
`) are used to split a single line of text into multiple lines. By sending a specially crafted Basic Authorization request, an unauthenticated remote attacker can inject arbitrary properties, such as `user=root`, into temporary session files stored on disk. By subsequently manipulating cookies and triggering a session reload, the attacker can trick the system into recognizing these injected values as valid, granting full root administrative access without a password.
Approximately 1.5 to 2 million instances are estimated to be exposed worldwide. The flaw has been actively exploited by various actors, including the Sorry ransomware group and the threat actor Mr Rot13. Real-world impacts include the deployment of Golang-based ransomware, the installation of the Filemanager backdoor, and the theft of credentials via fake login pages. Attackers have also used the access to implant SSH public keys and deploy PHP webshells for remote command execution.
**Recommendations**
Update to versions 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, or 11.136.0.5 as applicable.
Update WP Squared to version 136.1.7 or later.
As a temporary mitigation, block inbound traffic on ports '2082', '2083', '2086', '2087', '2095', and '2096' or restrict access to trusted static IP addresses via a VPN.
As a temporary workaround, stop the `cpsrvd` or `cpdavd` services until patching is complete.
Perform a full rotation of all root, WHM, reseller, and user passwords, as well as API tokens, SSL private keys, and SSH keys.