This vulnerability involves improper certificate validation in the DNS Cluster system of WebPros cPanel versions 11.126.0.0 through 11.136.0.0. SSL verification is disabled, which can enable an attacker controlling a malicious server to intercept and capture credentials by performing a man-in-the-middle attack. The CVSS v3.1 base score is 8.2, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but limited integrity impact.

An attacker able to position themselves as a man-in-the-middle between the vulnerable cPanel DNS Cluster system and its communication partner could capture sensitive credentials. This compromises confidentiality but does not directly affect system availability or integrity. The vulnerability affects multiple released versions of cPanel and could lead to credential theft if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor WebPros advisories for updates. Until a patch is available, consider restricting network access to the DNS Cluster system to trusted hosts only to reduce exposure.