An urgent security flaw has been discovered in the LiteSpeed User-End cPanel Plugin, identified as CVE-2026-48172. This critical vulnerability allows attackers to gain elevated privileges, potentially escalating to root access on affected systems. This issue has been actively exploited in the wild, making immediate attention crucial for all users.<\/p>\n
This vulnerability affects the LiteSpeed cPanel Plugin, which is widely used in cPanel environments to enhance web server performance. It was publicly disclosed on May 21, 2026, and is currently under “Analyzed” status, indicating that its details and impact have been thoroughly reviewed by security experts. Given its severe potential for system compromise, it has been assigned a CRITICAL severity rating.<\/p>\n
The core vulnerability impacts specific versions of the LiteSpeed User-End cPanel Plugin<\/strong>, particularly those ranging from v2.3 up to and including v2.4.4. While the LiteSpeed WHM Plugin was not directly affected by this particular privilege escalation flaw, both plugins are typically bundled together, and their updates are often released in unison. Therefore, users of LiteSpeed\u2019s cPanel and WHM environments should consider their installations at risk if the cPanel plugin component is within the vulnerable range.<\/p>\n The vulnerability, CVE-2026-48172, is in an “Analyzed” state, meaning its technical specifics and impact are well understood. Alarmingly, this flaw has been exploited in real-world attacks. Attackers are leveraging a weakness related to how the plugin handles Redis enable\/disable features (specifically the With a CVSS Score of 9.8, CVE-2026-48172 is classified as CRITICAL. This is the highest possible severity, reflecting the ease with which an attacker can exploit the flaw and the profound impact of a successful attack. A successful exploit could allow any cPanel user, including a malicious actor or a compromised account, to execute commands as the root user. This level of access grants complete control over the server, allowing for data theft, system modification, or further attacks.<\/p>\n LiteSpeed Technologies has released updates to address this critical issue. We strongly recommend the following actions:<\/p>\n If this command produces no output, your server has not been affected by the exploitation of this specific vulnerability. However, if there is output, you should carefully examine the listed IP addresses. Block any suspicious or invalid IP addresses and thoroughly review system logs for any actions taken by these detected IPs to assess the extent of potential damage. Contacting your support team for assistance in such cases is highly advisable.<\/p>\n<\/li>\n Note that this is a temporary measure to prevent exploitation and should be followed by a full upgrade as soon as possible.<\/p>\n<\/ul>\n Security Update for LiteSpeed cPanel Plugin<\/a><\/p><\/blockquote>\nCurrent Status<\/h2>\n
lsws.redisAble<\/code> function) to run arbitrary scripts with root privileges. This active exploitation underscores the urgency of applying available fixes.<\/p>\nSeverity Level<\/h2>\n
Possible Solutions<\/h2>\n
\n
grep -rE \"cpanel_jsonapi_func=redisAble\" \/var\/cpanel\/logs \/usr\/local\/cpanel\/logs\/ 2>\/dev\/null<\/code><\/pre>\n\/usr\/local\/lsws\/admin\/misc\/lscmctl cpanelplugin --uninstall<\/code><\/pre>\nReferences<\/h2>\n