PT-2026-35936 · Cpanel · Wp Squared+1

Published 2026-04-29 · Updated 2026-04-29 · CVE-2026-41940

NVD

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

cPanel and WHM versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, and 11.136.0.5 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-41940

Affected Products

Wp Squared

Cpanel & Whm

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-41940 · Security Note
• https://docs.wpsquared.com/changelogs/versions/changelog/#13617 · Note
• https://docs.cpanel.net/release-notes/release-notes · Note
• https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026 · Patch, Vendor Advisory
• https://namecheap.com/status-updates/ongoing-critical-security-vulnerability-in-cpanel-april-28-2026 · Note
• https://vulncheck.com/advisories/cpanel-and-whm-authentication-bypass-via-login-flow · Note