wp squared vulnerabilities and fixes

Recent CVEs affecting wp squared, with upgrade or downgrade steps. 3 tracked.

Also searched as: wpsquared.

wp squared has 3 tracked vulnerabilities, 1 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 3. Most recent: 2026-05-13. Highest priority: CVE-2026-41940 (score 100/100).

• CVE-2026-41940 CRITICAL 9.8 EXPLOITED UPGRADE UPGRADE WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability
• CVE-2026-29205 HIGH 8.6 UPGRADE UPGRADE Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via
• CVE-2026-32992 HIGH 8.2 UPGRADE UPGRADE SSL verification is disabled in the DNS Cluster system

FAQ

How do I fix wp squared vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is wp squared being exploited right now?

Yes: 1 wp squared CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.

Which wp squared CVE should I patch first?

CVE-2026-41940 currently ranks highest (100/100): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability.

RSS feed for wp squared · ← Back to latest CVEs