The vulnerability arises from improper sanitization of the status query parameter on the /unprotected/nova_error endpoint, allowing an unauthenticated attacker to inject arbitrary HTTP headers into the server’s response. This flaw—classified under CWE‑93—enables the attacker to manipulate response headers, potentially facilitating phishing, session hijacking, or other information‑disclosure attacks by altering client‑side behavior.

The affected systems are WebPros WP Squared and WebPros cPanel (WHM). No specific version information is provided in the available data, so all installations of these products should be considered potentially vulnerable until confirmed patched or assessed.

The CVSS score of 8.3 indicates a high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploitation likelihood is not well known but remains a concern. Because the endpoint is unprotected and authentication is not required, an attacker only needs to send a crafted HTTP request over the network to exploit the flaw. Successful exploitation could allow arbitrary header injection, which may serve as a vector for further attacks.