This vulnerability (CVE-2026-32993) in WebPros cPanel arises from improper sanitization of the 'status' query parameter in the /unprotected/nova_error endpoint. An unauthenticated attacker can exploit this to inject arbitrary HTTP headers via CRLF injection, potentially manipulating HTTP responses. The affected versions are 11.132.0.0, 11.134.0.0, and 11.136.0.0. The CVSS 3.1 base score is 8.3, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to inject arbitrary HTTP headers into responses from the vulnerable endpoint, which may lead to partial compromise of confidentiality, integrity, and availability of the affected system. The exact impact depends on how the injected headers are processed by clients or intermediaries. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is provided, users should monitor WebPros advisories for updates. Until a patch is available, consider restricting access to the vulnerable endpoint if possible or applying web application firewall rules to detect and block suspicious input targeting the 'status' parameter.