{"id":"litespeed-cpanel-root-access-may-2026","category":"patch","status":"closed","title":"LiteSpeed cPanel plugin flaw CVE-2026-48172 used to take full control of hosting servers","tldr":"Attackers used LiteSpeed’s cPanel plugin to turn an ordinary hosting account into full server control. Website owners should ask their host to update the plugin and check for compromise. Updating the WordPress cache plugin does not address this flaw.","summary":"CVE-2026-48172 lets someone with an ordinary cPanel account run scripts with full administrator rights on the hosting server. LiteSpeed confirmed active exploitation in May; CISA listed it on 26 May. LiteSpeed identifies user-end plugin versions 2.3–2.4.4 as vulnerable and says 2.4.5 fixed the original Redis-related flaw. It recommended 2.4.7, bundled with WHM plugin 5.3.1.0, after reviewing both plugins. MITRE’s product table lists broader affected ranges—cPanel plugin before 2.4.7 and WHM plugin before 5.3.1.0—whereas LiteSpeed explicitly says WHM was unaffected by the original flaw. Further root-access protections arrived in user-end plugin 2.4.8 on 1 June. As at 3 November, the latest listed bundle is WHM 5.3.6.0 with user-end plugin 2.4.10.0. Fixes are available, but the reviewed sources do not establish when attacks stopped or how many servers were compromised.","action":"If you own a website, ask your hosting provider to install LiteSpeed WHM plugin 5.3.6.0 or later, bundled with user-end plugin 2.4.10.0, and investigate signs of earlier compromise. If updating is impossible, ask it to remove the user-end plugin using LiteSpeed’s instructions.","product":"LiteSpeed user-end plugin for cPanel on web-hosting servers","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-48172"],"tags":["litespeed","cpanel","web-hosting","linux","privilege-escalation","actively-exploited"],"affected":["LiteSpeed user-end cPanel plugin versions 2.3–2.4.4, according to LiteSpeed; the original flaw did not affect its WHM plugin."],"fixed":["LiteSpeed user-end cPanel plugin 2.4.5: original flaw fixed.","LiteSpeed user-end cPanel plugin 2.4.7, bundled with WHM plugin 5.3.1.0: vendor-recommended May security update."],"matches":[],"sources":[{"kind":"advisory","title":"Security Update for LiteSpeed cPanel Plugin","url":"https://blog.litespeedtech.com/2026/05/21/security-update-for-litespeed-cpanel-plugin/","by":"LiteSpeed Technologies","date":"2026-05-21"},{"kind":"advisory","title":"Control Panel Plugins Release Log","url":"https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/release-log","by":"LiteSpeed Technologies","date":"2026-09-22"},{"kind":"advisory","title":"Security: LiteSpeed plugin automatically removed during nightly update - May 19, 2026","url":"https://support.cpanel.net/hc/en-us/articles/40599423437079-Security-LiteSpeed-plugin-automatically-removed-during-nightly-update-May-19-2026","by":"cPanel","date":"2026-05-20"},{"kind":"news","title":"LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts as Root","url":"https://thehackernews.com/2026/05/litespeed-cpanel-plugin-cve-2026-48172.html","by":"The Hacker News","date":"2026-05-23"},{"kind":"advisory","title":"Critical Vulnerability in LiteSpeed User-End cPanel Plugin","url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-061/","by":"Cyber Security Agency of Singapore","date":"2026-05-26"},{"kind":"advisory","title":"CVE-2026-48172","url":"https://www.cve.org/CVERecord?id=CVE-2026-48172","by":"MITRE","date":"2026-05-24"}],"started":"2026-05-19","closed":"2026-09-22","created":"2026-11-03T22:21:10.899Z","updated":"2026-11-03T22:21:10.899Z","cve_notes":[{"cve":"CVE-2026-48172","name":"Root privilege escalation in LiteSpeed’s cPanel plugin","what":"Incorrect privileges in the user-end plugin’s Redis controls let an authenticated cPanel user run scripts as root and take full control of the hosting server.","severity":"unknown","cvss":10}],"timeline":[{"at":"2026-09-22","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"LiteSpeed released WHM plugin 5.3.6.0 with user-end plugin 2.4.10.0. These are the latest versions listed in its release log as checked for this record.","url":"https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/release-log","by":"LiteSpeed Technologies","patch":null},{"at":"2026-06-01","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"LiteSpeed released user-end plugin 2.4.8 with further protection against a reported flaw that let an authenticated cPanel user gain root privileges. The release log also records WHM updates 5.3.2.0 and 5.3.2.1.","url":"https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/release-log","by":"LiteSpeed Technologies","patch":null},{"at":"2026-05-26","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-48172 to its Known Exploited Vulnerabilities catalogue, with a 29 May remediation deadline for US federal civilian agencies.","url":"https://thehackernews.com/2026/05/litespeed-cpanel-plugin-cve-2026-48172.html","by":"The Hacker News","patch":null},{"at":"2026-05-21","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"LiteSpeed disclosed active exploitation of CVE-2026-48172, affecting user-end plugin versions 2.3–2.4.4. It said 2.4.5 fixed the original flaw and recommended 2.4.7, bundled with WHM plugin 5.3.1.0, after a broader security review.","url":"https://blog.litespeedtech.com/2026/05/21/security-update-for-litespeed-cpanel-plugin/","by":"LiteSpeed Technologies","patch":"patched"},{"at":"2026-05-19","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"cPanel began automatically removing LiteSpeed’s user-end plugin during updates to prevent unauthorised root access. It said the LiteSpeed web service would continue working.","url":"https://support.cpanel.net/hc/en-us/articles/40599423437079-Security-LiteSpeed-plugin-automatically-removed-during-nightly-update-May-19-2026","by":"cPanel","patch":null}],"url":"https://hard.fyi/live/litespeed-cpanel-root-access-may-2026/","json":"https://hard.fyi/api/live?id=litespeed-cpanel-root-access-may-2026"}