An authentication bypass flaw in the cPanel and WHM login flow allows an unauthenticated remote attacker to gain control of the management console. The vulnerability exploits improper authentication checks (CWE-306), enabling attackers to obtain privileged access without valid credentials, thereby threatening the confidentiality, integrity, and availability of the hosted services.

The flaw applies to cPanel and WHM versions after 11.40. The CNA list also includes WP Squared, but the CVE narrative does not specify affected WP Squared releases, so administrators should consider all recent WP Squared versions potentially vulnerable. Because the version information is explicitly stated for cPanel and WHM, users should verify that they are running 11.40 or newer to assess risk.

The CVSS score of 9.3 indicates critical severity. The EPSS score of 91% indicates an extremely high likelihood of exploitation, and the vulnerability is listed in the CISA KEV catalog, confirming that it has been actively exploited. The likely attack vector is the login flow (inferred), allowing an unauthenticated attacker to acquire an authenticated session without valid credentials. The KEV listing underscores the urgency, as vulnerable hosts remain at risk.