cPanel & WHM and WP Squared login bypass CVE-2026-41940 exploited, including by 'Sorry' ransomware
A critical login bypass in cPanel & WHM and WP Squared (CVE-2026-41940) lets attackers into hosting control panels without a password. Used in attacks since at least February, including ransomware. Fixes are out.
If you run a server with cPanel & WHM or WP Squared, update to a fixed build now, check it with /usr/local/cpanel/cpanel -V, and run cPanel's compromise-check script. If your website sits on shared hosting, ask your host whether it has patched and checked for compromise; there is nothing to install yourself.
What’s happening
CVE-2026-41940 is a login flaw in cPanel & WHM, the control panel many web hosts use, and in WP Squared, a managed WordPress product built on it. It lets an attacker reach the panel with administrator rights without a valid password. WebPros published its advisory and updates on 28 April 2026. CISA listed the flaw as used in attacks on 30 April, including by ransomware gangs. Help Net Security reports exploitation began as early as 23 February, before any fix. Once a fix and public technical details appeared, several groups moved in: the 'Sorry' ransomware, a Mirai botnet variant, an unattributed espionage actor and a backdoor group called Mr_Rot13. Fixed builds exist for each supported cPanel release line, and cPanel supplies a script to check for signs of compromise. The latest coverage found is from May and June 2026, and the current scale of attacks is not known. Sources disagree on one detail: Rapid7 lists WP Squared 136.1.7 as the fixed version, while Help Net Security lists it as affected.
- What
- Flaw
- Affects
- WebPros cPanel & WHM and WP Squared (WordPress Squared) hosting control panels
- Affected
- cPanel & WHM: all versions after 11.40 (per Help Net Security and Rapid7, reporting the vendor)
WP Squared (WordPress Squared): versions before the fixed release - Fixed in
- cPanel & WHM 11.86.0.41
cPanel & WHM 11.94.0.28
cPanel & WHM 11.102.0.39
cPanel & WHM 11.110.0.97
cPanel & WHM 11.118.0.63
cPanel & WHM 11.124.0.35
cPanel & WHM 11.126.0.54
cPanel & WHM 11.130.0.19
cPanel & WHM 11.132.0.29
cPanel & WHM 11.134.0.20
cPanel & WHM 11.136.0.5 - Since
- 28 Apr 2026
- Closed
- 12 May 2026
Timeline
- Wider attacks
XLab reported a further campaign by a group it calls Mr_Rot13 that installs a backdoor, hidden SSH key and password-stealing login page on compromised servers. A Macnica researcher said 194 of 1,692 exposed cPanel/WHM servers in Japan had been hit by Sorry ransomware.
- Wider attacks
Multiple groups were exploiting the flaw: the 'Sorry' ransomware (files renamed .sorry, ransom note via Tox), a Mirai botnet variant, and an unattributed espionage actor. Censys found 8,859 hosts with open directories holding .sorry files. cPanel updated its compromise-check script after the first version gave many false alarms.
- CISA addedFixed
CISA listed CVE-2026-41940 as exploited in attacks (Help Net Security's later update gives 1 May). Rapid7 published fixed build numbers for each cPanel release line and described a CVSS 9.8 login flaw giving administrator access without a password.
- Made publicFixed
WebPros published its cPanel & WHM security advisory and released updates a few hours later. All versions after 11.40 were affected, plus WP Squared.
- Update
Help Net Security reports attackers were seen exploiting the flaw from this date, two months before a fix existed. This is the reporter's account and the vendor's advisory was not available to confirm it.
Sources
- cPanel & WHM Security Update 04/28/2026 (could not be opened; cited by CISA)WebPros cPanel · 28 Apr 2026
- CVE-2026-41940: cPanel & WHM Authentication BypassRapid7 · 30 Apr 2026
- cPanel zero-day exploited for months before patch release (CVE-2026-41940)Help Net Security · 30 Apr 2026
- Multiple threat actors actively exploit cPanel vulnerability (CVE-2026-41940)Help Net Security · 4 May 2026
- Stealthy hackers exploit cPanel flaw in active backdoor campaign (CVE-2026-41940)Help Net Security · 12 May 2026