LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts as Root
A critical vulnerability (CVE-2026-48172) in the LiteSpeed cPanel Plugin allows attackers to execute scripts with root privileges. The vulnerability is actively being exploited.
The LiteSpeed User-End cPanel Plugin is experiencing an active exploitation of a maximum-severity vulnerability (CVSS score: 10.0) due to incorrect privilege assignment. Attackers can leverage the `cpanel_jsonapi_func=redisAble` function to gain root access. Security researchers have identified and reported the flaw, leading to a patched version of the plugin.
Imagine a computer program has a secret key that lets it do special things, like run commands as an administrator. This plugin had a mistake where the key was given out too easily. An attacker found this mistake and used it to trick the program into running commands as the most powerful user – the root user. This means they could do anything on the computer. The developers fixed the mistake by changing the key, so it's harder for attackers to trick the program. They also gave users a way to check if their computer is affected and what to do about it.
Analysis
The vulnerability, CVE-2026-48172, stems from an improper privilege assignment within the LiteSpeed cPanel Plugin. Specifically, the cpanel_jsonapi_func=redisAble function, when exploited, allows an attacker or compromised account to execute arbitrary scripts with elevated permissions – namely, root access. According to LiteSpeed, 'Any cPanel user (including an attacker or a compromised account) may exploit the lsws.redisAble function to execute arbitrary scripts as root.' This means an attacker could bypass standard security controls and gain complete control over the server, potentially installing malware, stealing data, or disrupting services. The vulnerability affects all versions of the plugin between 2.3 and 2.4.4. The vulnerability was discovered and reported by David Strydom, a security researcher. LiteSpeed initially refrained from disclosing specific details to mitigate the immediate risk, but has since released version 2.4.5 to address the issue. Following a security review, LiteSpeed has further patched additional potential attack vectors in both the cPanel and WHM plugins. The development comes on the heels of another critical cPanel vulnerability (CVE-2026-41940) that was also actively exploited. The vulnerability is being actively exploited, highlighting the importance of timely patching and proactive security monitoring. The company has provided a grep command to identify affected systems. The vulnerability has been addressed in version 2.4.7, bundled with WHM plugin version 5.3.1.0. Users are advised to upgrade to the latest version to mitigate the risk.
Key points
- CVE-2026-48172 is a maximum-severity vulnerability in the LiteSpeed cPanel Plugin.
- The vulnerability allows attackers to execute scripts as root.
- The vulnerability affects versions 2.3 to 2.4.4 of the plugin.
- Security researcher David Strydom discovered and reported the flaw.
- LiteSpeed released version 2.4.5 to address the vulnerability.
- Users are advised to upgrade to the latest version (2.4.7) or uninstall the user-end plugin.
