LiteSpeed cPanel Plugin Flaw Enables Privilege Escalation to Root
Active Exploitation · 14 sources · Updated 5mo ago · First seen May 20, 2026
A privilege-escalation vulnerability tracked as CVE-2026-48172 affects the LiteSpeed User-End cPanel Plugin in versions before 2.4.5 and was reportedly exploited in the wild. The flaw is tied to improper handling of Redis enable/disable functionality and could allow an attacker to escalate privileges, potentially reaching root access. The related LiteSpeed WHM Plugin was identified as the parent plugin but was not affected.
In response, cPanel said the LiteSpeed plugin was automatically removed during a nightly update, indicating active mitigation for affected environments. Defenders were advised to review cPanel log directories for requests containing:
cpanel_jsonapi_func=redisAble
and to investigate associated IP addresses and broader system logs to determine whether exploitation attempts or successful compromise occurred.
