The vulnerability resides in the DNS Cluster system of WebPros cPanel and WP Squared where SSL certificate verification has been disabled. This weakness, identified as CWE‑295, permits an attacker to intercept and alter traffic between the client and the server. By compromising the SSL validation process, an attacker could further read or modify transmitted data, exposing authentication credentials and other sensitive information. The impact therefore includes potential confidentiality breach and unauthorized control over user sessions.

The affected products are WebPros cPanel and WP Squared. No specific version numbers are listed in the available data, so all current installations of these products are potentially impacted until a patched version is deployed.

The CVSS score of 8.2 reflects a high severity, and the EPSS score is not available, which means the current exploitation likelihood is unknown. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network compromise involving the DNS Cluster; an attacker who can influence DNS traffic or gain control of the DNS Cluster configuration can inject forged SSL certificates to perform a man‑in‑the‑middle attack. The absence of SSL verification removes the primary integrity and authenticity checks, enabling credential theft if the attacker gains appropriate network access.