cPanel Vulnerability: 7 Critical Steps to Stay Safe

The cPanel vulnerability known as CVE-2026-41940 is serious news for businesses using WHM, cPanel, WordPress, Joomla and shared hosting environments. This is not just another plugin issue. It affects the hosting control panel layer that many website owners rely on to manage files, databases, email accounts, domains and backups.

For many Gold Coast businesses, cPanel and WHM sit behind their WordPress or Joomla website. You may never log into WHM yourself, but your hosting provider, web agency or managed service provider may use it every day. If that server layer is compromised, every website hosted on that environment could be at risk.

This article explains what the vulnerability means, why it matters to WordPress and Joomla website owners, how to protect your website, and what to do if your website has already been hacked. If you need urgent help, our team provides Fix Hacked WordPress Website support for businesses on the Gold Coast and across Australia.

What Is the cPanel Vulnerability?

The cPanel vulnerability, tracked as CVE-2026-41940, is an authentication bypass affecting cPanel and WebHost Manager, often shortened to WHM. cPanel is commonly used by website owners to manage their hosting accounts. WHM is used by hosting companies, server administrators and agencies to manage server-level access across many hosting accounts.

The issue matters because an authentication bypass can allow an attacker to get around normal login protections. In plain language, a vulnerable server may allow an attacker to gain access without needing the correct username, password or two-factor authentication flow.

When a control panel is compromised, the damage can go far beyond a single website. An attacker may be able to access website files, databases, email accounts, DNS settings, SSL settings, backups and server configuration. For a single business website, that is bad enough. For a shared hosting server or managed hosting provider, it can affect many customers at once.

This is why website owners should treat the cPanel vulnerability as a hosting security event, not only a WordPress or Joomla problem.

Why WordPress and Joomla Websites Are Affected

WordPress and Joomla websites often run on Linux hosting environments managed through cPanel. The CMS itself may be fully updated, but that does not mean the hosting layer is safe.

A typical cPanel hosting account can include:

• Website files for WordPress, Joomla or another CMS.
• MySQL or MariaDB databases.
• Email accounts and forwarders.
• FTP and SFTP accounts.
• Domain and subdomain settings.
• SSL certificate settings.
• Backups or backup configuration.
• Access to file managers and database tools.

If an attacker gets server or control panel access, they may be able to modify WordPress themes, upload malware into plugin folders, inject spam into Joomla templates, create new admin users, add redirect scripts, steal database content or set up persistence so the hack comes back after a basic clean-up.

This is why cleaning only the WordPress dashboard is not enough when the hosting layer may have been affected. You need to check the website, database, users, hosting account, credentials, logs and backup chain.

Why This cPanel Vulnerability Is Dangerous

The risk is high because WHM and cPanel are privileged systems. They are not just website editing tools. They can provide access to the parts of a hosting account that sit underneath your CMS.

The most serious risks include:

• Server-level access: Attackers may reach areas outside the WordPress or Joomla dashboard.
• Multiple website exposure: Shared hosting environments can host many websites under one infrastructure stack.
• Database theft: Customer records, orders, form submissions and private content may be exposed.
• Email compromise: Attackers may use email accounts for phishing, invoice scams or password resets.
• Malware injection: Bad code can be added to themes, plugins, uploads or hidden files.
• SEO spam: Hackers may insert spam pages, hidden links and redirects that harm search visibility.
• Ransomware risk: Some reports link exploitation attempts to ransomware activity against exposed systems.

For businesses, the real cost is not only technical. A hacked website can damage customer trust, interrupt leads and sales, trigger Google warnings, affect email deliverability and create a lot of clean-up work.

7 Critical Steps to Protect Your Website

If your website runs on cPanel or WHM hosting, take the following steps now. Some of these actions require your hosting provider. Others can be handled by your web developer or maintenance team.

Step 1: Ask Your Host If cPanel and WHM Are Patched

Your first job is to confirm whether your hosting provider has updated cPanel and WHM to a patched version. If you manage your own VPS or dedicated server, log into WHM and check the installed version. If you are on shared hosting, ask your provider for written confirmation.

Ask these questions:

• Has the server been patched for CVE-2026-41940?
• What cPanel or WHM version is currently running?
• Was the official cPanel detection script run?
• Were any indicators of compromise found?
• Were logs reviewed for suspicious WHM, cPanel or root activity?
• Were customer accounts isolated and checked?

Do not assume your server is safe because your website still loads. Many compromised websites look normal at first. Attackers often hide access for later use.

Step 2: Run a Full Hosting and Website Security Scan

A WordPress malware plugin can help, but it does not see everything. If the issue came through the hosting layer, the scan should include the server account and website files.

For WordPress websites, scan:

• WordPress core files.
• Theme folders.
• Plugin folders.
• The uploads directory.
• Unknown PHP files.
• Modified .htaccess files.
• wp-config.php.
• Database tables for injected scripts or spam links.
• Admin user accounts.

For Joomla websites, scan:

• Core Joomla files.
• Templates.
• Extensions and plugins.
• Media folders.
• configuration.php.
• Database content.
• Super user accounts.
• Unexpected cron jobs or scheduled tasks.

For hosting accounts, check:

• FTP users.
• Email accounts.
• Forwarders.
• Databases and database users.
• SSH keys.
• File permissions.
• Cron jobs.
• Backup files stored inside public folders.

If you need help assessing a WordPress site, read our guide on WordPress Website Security 2025.

Step 3: Change All Passwords and Rotate Access

After patching and scanning, rotate credentials. If an attacker gained access through cPanel or WHM, they may have copied passwords, created new accounts or set up other access points.

Change passwords for:

• WHM.
• cPanel.
• WordPress or Joomla admin users.
• FTP and SFTP accounts.
• SSH access.
• Database users.
• Email accounts.
• Hosting provider accounts.
• Domain registrar accounts.
• Cloudflare or DNS accounts.

Use a password manager and make every password unique. Reusing one password across your website, hosting and email accounts can turn one breach into a full business compromise.

Turn on two-factor authentication for your hosting provider, WordPress admin users, Joomla super users, DNS provider and email accounts. Two-factor authentication does not patch the cPanel vulnerability itself, but it helps reduce other login risks.

Step 4: Check for New Admin Users and Backdoors

Attackers often create their own way back in. This may be a new admin user, a hidden PHP file, a malicious plugin, a fake Joomla extension, a cron job, an SSH key or a modified configuration file.

In WordPress, check:

• Users with Administrator roles.
• Unknown plugins.
• Recently modified theme files.
• Files with random names in wp-content/uploads.
• Unexpected code in functions.php.
• Suspicious options in the database.

In Joomla, check:

• Super User accounts.
• Installed extensions.
• Template overrides.
• Unknown PHP files in media directories.
• Recently modified configuration files.
• Unexpected scheduled tasks.

Backdoors are the reason many hacked websites get cleaned, then hacked again. A surface-level clean-up may remove the visible problem but leave the attacker’s access behind.

Step 5: Restore from a Clean Backup If Needed

If your website has been altered, a clean backup may be the safest recovery path. The key word is clean. Restoring a backup from after the compromise can bring the malware back.

Before restoring, confirm:

• The backup date is before the suspected compromise.
• The backup includes both files and database.
• The restored website is patched before going live.
• Passwords are rotated after the restore.
• The hosting environment has been patched.
• Malware scanning is run after the restore.

Backups should be stored offsite, not only inside the same hosting account. If a hosting account is compromised, backups stored in public or accessible directories may be deleted, changed or encrypted.

We have a detailed guide on backups for WordPress websites if you need to strengthen your recovery process.

Step 6: Harden WordPress, Joomla and the Hosting Layer

Once the urgent issue is patched and cleaned, harden the website. This reduces the chance of a different attack succeeding later.

For WordPress:

• Update WordPress core, themes and plugins.
• Remove unused plugins and themes.
• Use a security plugin such as Wordfence or Solid Security Pro.
• Enable two-factor authentication for admin users.
• Limit login attempts.
• Disable file editing in the WordPress dashboard.
• Set correct file permissions.
• Use a Web Application Firewall.
• Add security headers.
• Set up uptime and malware monitoring.

For Joomla:

• Update Joomla core and extensions.
• Remove unused extensions and templates.
• Use strong Super User passwords.
• Enable two-factor authentication.
• Restrict administrator access where practical.
• Check file permissions.
• Move backups outside public web folders.
• Monitor logs and file changes.

For hosting:

• Patch WHM and cPanel.
• Disable unused services.
• Restrict access to WHM where practical.
• Review SSH access.
• Review cron jobs.
• Check DNS and email settings.
• Use Cloudflare or another trusted firewall layer.
• Keep server software updated.

You can learn more about strengthening browser-level protection in our article on security headers for WordPress.

Step 7: Move to Managed WordPress Hosting Where It Makes Sense

Many small business websites sit on cheap shared hosting because it is easy to buy and familiar to use. That can be fine for small brochure websites, but it can create risk when server updates, monitoring, backups and malware response are weak.

For WordPress businesses that need stronger support, managed WordPress hosting can be a better fit. A managed environment can reduce the need to rely on cPanel, improve backup handling, simplify updates and provide a more WordPress-focused security setup.

At Mesh With Us, we often recommend better hosting as part of a security clean-up, especially when the current server has been compromised or is not maintained well. For some websites, a move away from budget shared hosting is the difference between repeating the same problem and getting a more stable foundation.

If you are reviewing your hosting, we have written about Pressable managed WordPress hosting. You can also review Pressable hosting directly if you want a managed WordPress option backed by Automattic.

How to Tell If Your Website Has Been Hacked

Not all hacks are obvious. Some attackers want attention. Others want quiet access. Watch for these signs:

• Your website redirects to another domain.
• Google shows a hacked site or unsafe warning.
• Customers report strange popups or spam pages.
• You find admin users you did not create.
• Your site is suddenly slow or unstable.
• Your emails start landing in spam.
• Your hosting provider suspends your account.
• New files appear in uploads, templates or plugin folders.
• Search results show casino, pharma or adult spam pages.
• Your sitemap contains URLs you did not publish.
• Security plugins report modified core files.

If your website uses cPanel hosting and you notice any of these signs, treat it as urgent. Do not only delete the visible spam page. You need to identify how it got there and whether server-level access was involved.

How to Unhack a WordPress Website After This cPanel Vulnerability

If your WordPress website has been hacked, use a careful process. Rushing can cause data loss or leave backdoors behind.

Start with a forensic backup. Even if the site is infected, keep a copy before making changes. This helps with investigation and gives you a rollback point if a clean-up damages functionality.

Next, take the site out of public view if it is serving malware or redirecting customers. A maintenance page or temporary block can reduce harm while the clean-up is underway.

Then clean in layers:

• Patch WHM and cPanel first.
• Check the hosting account for suspicious users, cron jobs and file changes.
• Change all credentials.
• Scan all WordPress files.
• Replace WordPress core files with clean copies.
• Replace infected plugins and themes with fresh versions from trusted sources.
• Clean or restore the database.
• Remove unknown admin users.
• Check uploads for PHP files or hidden scripts.
• Review .htaccess and wp-config.php.
• Set correct permissions.
• Install and configure a firewall.
• Submit a review request in Google Search Console if Google has flagged the site.

We cover this process in more detail in our guide: Is Your WordPress Website Hacked? This Is How You Recover.

How to Unhack a Joomla Website After a Hosting Compromise

Joomla clean-up follows the same principle: patch the server, preserve evidence, clean the files, clean the database and rotate access.

For Joomla websites, focus on:

• Updating Joomla core.
• Updating all extensions.
• Removing abandoned or unused extensions.
• Checking template files for injected scripts.
• Checking media folders for executable PHP files.
• Reviewing Super User accounts.
• Checking configuration.php for unexpected changes.
• Scanning the database for injected scripts or spam links.
• Reviewing .htaccess and web.config files.
• Moving the site to a safer hosting setup if the server remains risky.

Mesh With Us has worked with Joomla for many years and still supports businesses with legacy Joomla websites. If you need help, see our Joomla Web Development service page.

Why Cheap Shared Hosting Can Make Recovery Harder

Cheap hosting is attractive because it keeps monthly costs low. The problem is that recovery can become harder when the host gives limited access, poor backups, slow support or weak separation between accounts.

Common recovery problems include:

• No clean backup available.
• Backups stored on the same compromised server.
• No access to logs.
• Slow support response.
• Outdated PHP versions.
• Poor malware detection.
• Server-level issues outside the website owner’s control.
• Multiple sites infected under the same account.

For business websites, hosting is part of security. If your website brings in leads, bookings, sales or enquiries, the cheapest hosting plan may not be the cheapest choice once downtime and clean-up costs are included.

When to Get Professional Help

You should get help quickly if:

• Your host has confirmed compromise indicators.
• Your website redirects visitors to spam or scam pages.
• Google has flagged your site as unsafe.
• Your WordPress or Joomla admin access no longer works.
• Your email accounts may have been abused.
• You run WooCommerce or collect customer data.
• You do not have a clean backup.
• The hack keeps coming back after clean-up.
• You are not sure whether the server has been patched.

A professional clean-up should not only remove malware. It should identify the likely entry point, rotate credentials, harden the site, check users, review backups, scan the database and recommend safer hosting if needed.

Mesh With Us provides hacked WordPress recovery, security hardening, hosting migration and ongoing WordPress Maintenance and Support for Gold Coast and Australian businesses.

FAQs About the cPanel Vulnerability

Need Help Securing or Recovering Your Website?

The cPanel vulnerability is a reminder that website security is more than updating WordPress plugins. Your hosting, DNS, backups, admin accounts, server tools and website code all work together. If one layer is weak, the whole site can be exposed.

If you run a WordPress or Joomla website on the Gold Coast and you are worried about this issue, Mesh With Us can help. We can check your website, clean malware, review hosting, migrate to safer infrastructure and set up ongoing maintenance so your website is looked after properly.

Get urgent support through our Fix Hacked WordPress Website Gold Coast service, or contact us to discuss a security review for your website.