WebPros cPanel & WHM and WP2 (WordPress Squared) contain a critical authentication bypass vulnerability in the login flow. The vulnerability allows unauthenticated remote attackers to gain unauthorized access to the control panel without proper authentication. This affects the WebHost Manager interface and WordPress Squared products. The vulnerability has been assigned CVE-2026-41940 and is considered high severity. Security updates have been released on April 28, 2026 to address this issue. Organizations using these products should apply patches immediately to prevent unauthorized access.