Critical LiteSpeed cPanel Plugin Zero-Day Exploated for Root Access

Key Takeaways

• A critical zero-day vulnerability in LiteSpeed’s cPanel plugin is being actively exploited to achieve root access on Linux hosting servers.
• The flaw, identified as CVE-2026-48172, impacts LiteSpeed cPanel user-end plugin versions from v2.3 to v2.4.4.
• Attackers can leverage any valid cPanel user account to execute arbitrary commands with root privileges.
• Patches are available in LiteSpeed cPanel plugin v2.4.5 and later, and cPanel has also pushed an automated removal of the vulnerable plugin.

A severe zero-day privilege escalation vulnerability within the LiteSpeed cPanel user-end plugin is under active exploitation, granting attackers root access to vulnerable Linux hosting servers. LiteSpeed has acknowledged the flaw and subsequently released patches.

Exploitation in the Wild

The vulnerability, designated as CVE-2026-48172, impacts LiteSpeed cPanel user-end plugin versions ranging from v2.3 up to, but not including, v2.4.5. LiteSpeed confirmed that this flaw has been actively exploited in the wild, establishing its status as a true zero-day at the time of discovery.

According to LiteSpeed’s advisory, the issue resides within the lsws.redisAble function, exposed through the user-end cPanel plugin. This function can be misused by any standard cPanel user account to execute arbitrary scripts with root privileges. The ease of exploitation, requiring only a valid cPanel user login, means that a malicious tenant or an already compromised shared hosting account could easily escalate privileges to achieve full server takeover.

The vulnerability affects all deployments running the susceptible user-end plugin versions between v2.3 and v2.4.4. It’s important to note that the WHM plugin itself is not directly impacted. LiteSpeed has released a fix in cPanel plugin v2.4.5 and subsequent bundled releases, urging operators to update to the latest versions without delay. For more details, refer to the LiteSpeed security update.

What You Should Do

• Update Immediately: Upgrade to LiteSpeed cPanel plugin v2.4.5 or higher. LiteSpeed WHM Plugin v5.3.1.0 (which bundles cPanel plugin v2.4.7) or higher is strongly recommended, as it includes additional hardening beyond just the fix for CVE-2026-48172.
• Force cPanel Update: Run /scripts/upcp --force to ensure cPanel’s automated removal of the vulnerable plugin is applied.
• Check for Exploitation: Use the command grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null to scan cPanel logs for signs of exploit attempts. Investigate any positive results, validate source IPs, block suspicious addresses, and review system logs for post-compromise activities.
• Temporary Mitigation: If immediate patching is not feasible, uninstall the user-end plugin using /usr/local/lsws/admin/misc/lscmctl cpanelplugin --uninstall as a containment measure.
• Review Logs: Hosting providers and server administrators should assume potential compromise on unpatched systems and thoroughly review logs for suspicious activity originating from cPanel user contexts.

Timeline and Additional Hardening

The vulnerability was initially reported by security researcher David Strydom on May 19, 2026, prompting an immediate response from LiteSpeed and the cPanel/WebPros team. LiteSpeed rapidly released cPanel plugin v2.4.6 and WHM plugin v5.3.0.0 on the same day. The CVE-2026-48172 identifier was applied on May 20. A comprehensive security review followed, culminating in the release of cPanel plugin v2.4.7 and WHM plugin v5.3.1.0 on May 21.

During this expedited review process, additional security issues were identified and patched. However, there are no current reports of these secondary vulnerabilities being exploited in the wild. The swift action by LiteSpeed and cPanel underscores the severity of this zero-day and the urgency for administrators to update their systems.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.