cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

LiteSpeed Says CVE-2026-48172 in cPanel Plugin Is Actively Exploited to Run Scripts as Root

· Original article ↗

Summary

LiteSpeed says CVE-2026-48172, a critical flaw in its cPanel plugin that can let attackers run scripts as root, is actively exploited. Users should check logs and upgrade to plugin v2.4.7 or later, or uninstall it.

Key points

  • CVE-2026-48172 has a CVSS score of 10.0 and affects LiteSpeed User-End cPanel Plugin versions 2.3 through 2.4.4.
  • The privilege-assignment flaw lets a cPanel user abuse the lsws.redisAble function to run arbitrary scripts as root.
  • LiteSpeed says the vulnerability is actively exploited but did not provide further exploitation details.
  • LiteSpeed provided a grep command to check cPanel logs for the indicator cpanel_jsonapi_func=redisAble.
  • LiteSpeed says the issue was addressed in v2.4.5 and recommends upgrading to cPanel plugin v2.4.7 or later; the WHM plugin is not affected by this vulnerability.
  • If immediate patching is not possible, users are advised to uninstall the user-end plugin.

Article Details

Vulnerability Types
  • Incorrect privilege assignment
  • Privilege escalation to root
  • Arbitrary script execution
Severity
Critical; CVSS 10.0
Affected Versions
  • LiteSpeed User-End cPanel Plugin versions 2.3 through 2.4.4
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available
Workarounds
  • If immediate patching is not possible, uninstall the user-end plugin using `/usr/local/lsws/admin/misc/lscmctl cpanelplugin --uninstall`.

MITRE ATT&CK

T1068 · Exploitation for Privilege EscalationAttackers abuse the lsws.redisAble function in the vulnerable plugin to execute arbitrary scripts as root.

CVE

CVE-2026-41940WebPros · cPanel; WebPros · WHM; +1 moreThe development comes weeks after a critical cPanel vulnerability (CVE-2026-41940, CVSS score: 9.8) was identified as actively exploited by unknown threat actors to deploy Mirai botnet variants and a ransomware strainCVE-2026-48172Litespeedtech · Litespeed cpanel plugin; Litespeedtech · Litespeed whm pluginLiteSpeed User-End cPanel Plugin is affected by CVE-2026-48172, a critical privilege assignment flaw that is being actively exploited to run arbitrary scripts as root.

People

David StrydomCredited with discovering and reporting CVE-2026-48172.

Malware

Mirai(CVE-2026-41940, CVSS score: 9.8) was identified as actively exploited by unknown threat actors to deploy Mirai botnet variants and a ransomware strain called Sorry.Sorryexploited by unknown threat actors to deploy Mirai botnet variants and a ransomware strain called Sorry.

Vendors

LiteSpeedLiteSpeed User-End cPanel Plugin is affected by CVE-2026-48172, a critical privilege assignment flaw that is being actively exploited to run arbitrary scripts as root.

Products

cPanelLiteSpeed User-End cPanel Plugin is affected by CVE-2026-48172, a critical privilege assignment flaw that is being actively exploited to run arbitrary scripts as root.LiteSpeed User-End cPanel PluginLiteSpeed User-End cPanel Plugin is affected by CVE-2026-48172, a critical privilege assignment flaw that is being actively exploited to run arbitrary scripts as root.LiteSpeed WHM PluginUsers are advised to upgrade to LiteSpeed WHM Plugin version 5.3.1.0, which is bundled with cPanel plugin v2.4.7 or higher, to patch the vulnerability.WHMUsers should check for signs of exploitation, upgrade to cPanel plugin v2.4.7 or WHM plugin v5.3.1.0, or uninstall the plugin if patching cannot be done immediately.

Related Articles