An urgent security flaw has been discovered in the LiteSpeed User-End cPanel Plugin, identified as CVE-2026-48172. This critical vulnerability allows attackers to gain elevated privileges, potentially escalating to root access on affected systems. This issue has been actively exploited in the wild, making immediate attention crucial for all users.
CVE Details
This vulnerability affects the LiteSpeed cPanel Plugin, which is widely used in cPanel environments to enhance web server performance. It was publicly disclosed on May 21, 2026, and is currently under “Analyzed” status, indicating that its details and impact have been thoroughly reviewed by security experts. Given its severe potential for system compromise, it has been assigned a CRITICAL severity rating.
- Product: LiteSpeed cPanel Plugin
- Published: May 21, 2026
- Severity: CRITICAL
- Status: Analyzed
Affected Products
The core vulnerability impacts specific versions of the LiteSpeed User-End cPanel Plugin, particularly those ranging from v2.3 up to and including v2.4.4. While the LiteSpeed WHM Plugin was not directly affected by this particular privilege escalation flaw, both plugins are typically bundled together, and their updates are often released in unison. Therefore, users of LiteSpeed’s cPanel and WHM environments should consider their installations at risk if the cPanel plugin component is within the vulnerable range.
Current Status
The vulnerability, CVE-2026-48172, is in an “Analyzed” state, meaning its technical specifics and impact are well understood. Alarmingly, this flaw has been exploited in real-world attacks. Attackers are leveraging a weakness related to how the plugin handles Redis enable/disable features (specifically the lsws.redisAble function) to run arbitrary scripts with root privileges. This active exploitation underscores the urgency of applying available fixes.
Severity Level
With a CVSS Score of 9.8, CVE-2026-48172 is classified as CRITICAL. This is the highest possible severity, reflecting the ease with which an attacker can exploit the flaw and the profound impact of a successful attack. A successful exploit could allow any cPanel user, including a malicious actor or a compromised account, to execute commands as the root user. This level of access grants complete control over the server, allowing for data theft, system modification, or further attacks.
Possible Solutions
LiteSpeed Technologies has released updates to address this critical issue. We strongly recommend the following actions:
- Urgent Upgrade: The primary solution is to upgrade your LiteSpeed WHM Plugin to version v5.3.1.0 or higher. This version bundles the patched cPanel plugin v2.4.7, which resolves the privilege escalation vulnerability and other potential attack vectors discovered during a comprehensive security review.
- Detection: To determine if your server has already been targeted, run the following command in Bash:
grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/nullIf this command produces no output, your server has not been affected by the exploitation of this specific vulnerability. However, if there is output, you should carefully examine the listed IP addresses. Block any suspicious or invalid IP addresses and thoroughly review system logs for any actions taken by these detected IPs to assess the extent of potential damage. Contacting your support team for assistance in such cases is highly advisable.
- Temporary Mitigation: If an immediate upgrade is not feasible, you can temporarily remove the vulnerable user-end plugin by executing this command:
/usr/local/lsws/admin/misc/lscmctl cpanelplugin --uninstallNote that this is a temporary measure to prevent exploitation and should be followed by a full upgrade as soon as possible.
References
https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/cpanel
https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/release-log
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48172
