LiteSpeed cPanel Plugin Exploited to Run Scripts as Root
Security researchers have detected active exploitation of a high-severity vulnerability in the LiteSpeed user-end cPanel plugin. Tracked as CVE-2026-48172 and assigned a CVSS score of 10.0, the bug stems from improper privilege handling that can be abused to execute arbitrary scripts with root privileges via the lsws.redisAble functionality.
According to LiteSpeed, any cPanel account – whether belonging to an attacker or a compromised user – can leverage the lsws.redisAble routine to run scripts as the system superuser. The flaw affects plugin releases from 2.3 up to 2.4.4. The company said its WHM plugin was not vulnerable in the initial disclosure. An immediate remediation was made available in cPanel plugin version 2.4.5. Security researcher David Strydom is credited with discovering and reporting the issue. LiteSpeed confirmed the vulnerability is being used in the wild but declined to provide additional technical details at this time.
LiteSpeed published a simple indicator-of-compromise check administrators can run on affected hosts:
grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null
If that command returns no results, the server is not showing evidence of the specific activity. Any output should be investigated: review the originating IP addresses and, if they are not legitimate, block them and follow incident-response procedures.
Following an internal security review of both its cPanel and WHM integrations, LiteSpeed said it also closed additional potential attack vectors. It shipped a consolidated fix in cPanel plugin v2.4.7, which is included in WHM plugin version 5.3.1.0. Administrators are urged to update to LiteSpeed WHM Plugin 5.3.1.0 (bundled with cPanel plugin v2.4.7 or later) to ensure full protection.
For organizations that cannot apply the update immediately, LiteSpeed recommends removing the user-end plugin as a temporary mitigation by running:
/usr/local/lsws/admin/misc/lscmctl cpanelplugin --uninstall
This advisory arrives only weeks after another critical cPanel vulnerability, CVE-2026-41940 (CVSS 9.8), was reported to be actively exploited by unknown actors to install Mirai botnet variants and a ransomware family known as Sorry.
System administrators should prioritize patching or, if necessary, uninstalling the vulnerable plugin, review logs for the indicator above, and investigate any suspicious connections found during triage.