cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

CISA Urges Patching of Actively Exploited LiteSpeed cPanel Plugin Flaw

· Original article ↗

Summary

CVE-2026-48172, an actively exploited privilege-escalation flaw in LiteSpeed’s cPanel user-end plugin, could enable root-level script execution. CISA added it to the KEV catalog and set a May 29 patch-or-remove deadline for federal agencies.

Key points

  • CVE-2026-48172 is a critical-severity privilege-escalation vulnerability with a CVSS score of 9.8.
  • The flaw could let attackers execute arbitrary scripts with root privileges and has been exploited as a zero-day.
  • LiteSpeed said user-end plugin versions 2.3 through 2.4.4 are affected; its WHM plugin is not.
  • LiteSpeed recommends upgrading to WHM Plugin 5.3.1.0, bundled with user-end plugin 2.4.7, or later; if patching is not possible, remove the plugin.
  • LiteSpeed advises checking server logs and reviewing IPs associated with possible exploitation.
  • cPanel pushed a nightly update on May 19 that removed the user-end plugin across cPanel versions.
  • CISA added the vulnerability to its KEV catalog and urged federal agencies to patch or remove affected versions by May 29.

Article Details

Vulnerability Types
  • Privilege escalation allowing arbitrary script execution with root privileges
Severity
Critical (CVSS 9.8)
Affected Versions
  • LiteSpeed user-end plugin v2.3–v2.4.4
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available
Workarounds
  • If patching is not possible, completely remove the LiteSpeed user-end plugin.

CVE

CVE-2026-48172Litespeedtech · Litespeed cpanel plugin; Litespeedtech · Litespeed whm pluginTracked as CVE-2026-48172 (CVSS score of 9.8), the flaw is described as a privilege escalation issue that could allow attackers to execute arbitrary scripts with root privileges.

Vendors

cPanelCISA on Tuesday urged federal agencies to immediately patch a critical-severity vulnerability in the LiteSpeed user-end plugin for cPanel that has been exploited in the wild.LiteSpeedCISA on Tuesday urged federal agencies to immediately patch a critical-severity vulnerability in the LiteSpeed user-end plugin for cPanel that has been exploited in the wild.

Products

cPanelCISA on Tuesday urged federal agencies to immediately patch a critical-severity vulnerability in the LiteSpeed user-end plugin for cPanel that has been exploited in the wild.LiteSpeed user-end pluginCISA on Tuesday urged federal agencies to immediately patch a critical-severity vulnerability in the LiteSpeed user-end plugin for cPanel that has been exploited in the wild.LiteSpeed WHM PluginUsers should upgrade to LiteSpeed WHM Plugin version 5.3.1.0 (bundled with the user-end plugin version 2.4.7) or higher, which contain patches for the vulnerability.

Related Articles