CVE-2026-48172: LiteSpeed User-End cPanel Plugin privilege escalation to root

CVE-2026-48172 · Severity: critical · CVSS 10 · Exploited in the wild · Published 2026-05-21

A vulnerability in the LiteSpeed plugin for cPanel allows standard users to gain full administrative control over the web hosting server. This plugin is used by hosting providers to manage web server performance and features for their customers. An attacker can exploit this flaw to execute commands with root privileges, potentially leading to total system takeover, data theft, and service disruption.

Vendors: LiteSpeed Technologies.

Quick answers

Is CVE-2026-48172 exploited in the wild?
Yes. CVE-2026-48172 is known to be exploited in the wild, first recorded on 26 May 2026. Treat it as urgent.
How severe is CVE-2026-48172?
Critical severity, with a CVSS score of 10, published 21 May 2026.
Which products and versions are affected?
LiteSpeed Technologies User-End cPanel Plugin before 2.4.5.
Is there a fix for CVE-2026-48172?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-48172 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-48172?
Check whether you run LiteSpeed Technologies cPanel Plugin or LiteSpeed Technologies User-End cPanel Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The LiteSpeed User-End cPanel Plugin before version 2.4.5 is vulnerable to an incorrect privilege assignment (CWE-266) related to the mishandling of Redis enable/disable features. Specifically, the vulnerability is exposed via the 'redisAble' function in the user-end plugin's JSON API. A remote attacker with access to a standard cPanel user account can exploit this flaw to escalate privileges to root. This vulnerability has been observed being exploited in the wild as of May 2026. Administrators can check for exploitation by searching cPanel logs for the 'cpanel_jsonapi_func=redisAble' string. The LiteSpeed WHM (parent) plugin is reportedly unaffected.

Affected products

  • LiteSpeed User-End cPanel Plugin before 2.4.5

Timeline

  • 2026-05-20: disclosed
  • 2026-05-20: advisory
  • 2026-05-26: other: NVD Publication Date
  • 2026-05-01: exploited: Exploitation reported in the wild in May 2026

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.