onyx

onyx --cves cve-2026-41940

CVE-2026-41940

N/AKEVNUCLEI ↗WordPress
score
1.5
cvss
—
epss
98.5%
published
—
kev added
2026-04-30
first seen

WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

events2026-04-30 — Added to CISA KEVK2026-09-28 — First GitHub repository: ZeroDayEvil/CVE-2026-41940-PoC · new repositoryG2026-10-21 (seen by) — Tracked by OnyxT2026-10-21 (seen by) — Nuclei template: cPanel & WHM - Authentication Bypass via Session-File CRLF InjectionNscore2026-10-21: score 1.51.5epss2026-09-22: epss 98.5%2026-09-23: epss 98.5%2026-09-24: epss 98.5%2026-09-25: epss 98.5%2026-09-26: epss 98.5%2026-09-27: epss 98.5%2026-09-29: epss 98.5%2026-09-30: epss 98.5%2026-10-01: epss 98.5%2026-10-02: epss 98.5%2026-10-03: epss 98.5%2026-10-04: epss 98.5%2026-10-05: epss 98.5%2026-10-06: epss 98.5%2026-10-07: epss 98.5%2026-10-08: epss 98.5%2026-10-09: epss 98.5%2026-10-10: epss 98.5%2026-10-11: epss 98.5%2026-10-12: epss 98.5%2026-10-13: epss 98.5%2026-10-14: epss 98.5%2026-10-15: epss 98.5%2026-10-16: epss 98.5%2026-10-18: epss 98.5%2026-10-19: epss 98.5%2026-10-20: epss 98.5%2026-10-21: epss 98.5%98.5%mentions/day2026-09-28: mentions/day 12026-10-11: mentions/day 102026-09-22today
  1. Added to CISA KEV
  2. First GitHub repository ZeroDayEvil/CVE-2026-41940-PoC · new repository
  3. Tracked by Onyx
  4. Nuclei template cPanel & WHM - Authentication Bypass via Session-File CRLF Injection

Nuclei template

A verified check exists — you can scan for this today, and so can everyone else.

template
cPanel & WHM - Authentication Bypass via Session-File CRLF Injection
severity
CRIT
first seen
nuclei -id CVE-2026-41940 -u https://target.example

Community

0 mentions this week · —

GitHub repositories 2

Weaknesses

CWE-306

References 4