Critical Analysis: CVE-2026-41940 - WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Aut... — May 7, 2026

Published 07 May 2026 · vulnerability management, CVE analysis, threat intelligence, security operations, cybersecurity news

Alright team, pull up a chair. We've got a fresh critical to dissect today: CVE-2026-41940. This one's a nasty "Missing Authentication for Critical Function" vulnerability hitting both WebPros cPanel & WHM, and critically, their WP2 (WordPress Squared) component. The NVD entry just dropped on May 7, 2026, so the clock is ticking for a lot of system administrators out there. Let's break this down. Initial Discovery and Context From what I've gathered through my network and early analyses, this vulnerability wasn't a proactive disclosure by WebPros. It looks like it was likely stumbled upon by a third-party researcher, or perhaps an internal security audit that identified a serious architectural flaw. The advisory dropped with an alarming CVSSv3.1 score of 9.8, signaling an immediate and dire threat. This isn't some esoteric memory corruption bug requiring a full exploit development team;