WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 30/04/2026. Patch affected systems as an emergency. It is known to be used in ransomware campaigns.
| Package | Affected versions | Patched versions |
|---|---|---|
| cpanel | ≥ 11.40, < 86.0.41≥ 112.0.0, < 118.0.63≥ 120.0.0, < 124.0.35≥ 126.0.1, < 126.0.54≥ 128.0.0, < 130.0.19≥ 132.0.0, < 132.0.29≥ 134.0.0, < 134.0.20≥ 136.0.0, < 136.0.5≥ 88.0.0, < 110.0.97 | 86.0.41118.0.63124.0.35126.0.54130.0.19132.0.29134.0.20136.0.5110.0.97 |
| whm | ≥ 11.40, < 86.0.41≥ 112.0.0, < 118.0.63≥ 120.0.0, < 124.0.35≥ 126.0.1, < 126.0.54≥ 128.0.0, < 130.0.19≥ 132.0.0, < 132.0.29≥ 134.0.0, < 134.0.20≥ 136.0.0, < 136.0.5≥ 88.0.0, < 110.0.97 | 86.0.41118.0.63124.0.35126.0.54130.0.19132.0.29134.0.20136.0.5110.0.97 |
| wp squared | < 136.1.7 | 136.1.7 |
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free