Research · Apr 29, 2026 · ZeroDay Catalog
Critical Authentication Bypass Vulnerability in WebPros cPanel & WHM and WP2
A significant authentication bypass vulnerability has been identified in WebPros cPanel & WHM and WP2, allowing unauthorized access to critical functions.
What changed
WebPros has reported a critical vulnerability in cPanel & WHM and WP2 that allows unauthenticated remote attackers to bypass authentication mechanisms. This flaw could lead to unauthorized access to sensitive control panel functions.
The vulnerability specifically affects the login flow, posing a severe risk to the security of systems utilizing these products.
Who is affected
Organizations using WebPros cPanel & WHM and WP2 are at risk due to this vulnerability. The following groups are particularly vulnerable:
System administrators and web hosting providers relying on cPanel for managing client accounts and server configurations.
- WebPros cPanel & WHM users
- WP2 (WordPress Squared) users
- Web hosting providers utilizing cPanel
- System administrators managing web applications
What to do
It is crucial for affected users to assess their systems for this vulnerability and apply necessary patches or updates as soon as they are available. Implementing additional security measures can also help mitigate risks.
Regularly reviewing access logs and monitoring for unusual activity can further enhance security.
- Update to the latest version of cPanel & WHM and WP2 once patches are released.
- Implement strict access controls to limit exposure to the control panel.
- Monitor system logs for unauthorized access attempts.
- Consider additional security layers, such as firewalls and intrusion detection systems.