NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

LiteSpeed cPanel plugin flaw CVE-2026-48172 used to take full control of hosting servers

Attackers used LiteSpeed’s cPanel plugin to turn an ordinary hosting account into full server control. Website owners should ask their host to update the plugin and check for compromise. Updating the WordPress cache plugin does not address this flaw.

What to do

If you own a website, ask your hosting provider to install LiteSpeed WHM plugin 5.3.6.0 or later, bundled with user-end plugin 2.4.10.0, and investigate signs of earlier compromise. If updating is impossible, ask it to remove the user-end plugin using LiteSpeed’s instructions.

What’s happening

CVE-2026-48172 lets someone with an ordinary cPanel account run scripts with full administrator rights on the hosting server. LiteSpeed confirmed active exploitation in May; CISA listed it on 26 May. LiteSpeed identifies user-end plugin versions 2.3–2.4.4 as vulnerable and says 2.4.5 fixed the original Redis-related flaw. It recommended 2.4.7, bundled with WHM plugin 5.3.1.0, after reviewing both plugins. MITRE’s product table lists broader affected ranges—cPanel plugin before 2.4.7 and WHM plugin before 5.3.1.0—whereas LiteSpeed explicitly says WHM was unaffected by the original flaw. Further root-access protections arrived in user-end plugin 2.4.8 on 1 June. As at 3 November, the latest listed bundle is WHM 5.3.6.0 with user-end plugin 2.4.10.0. Fixes are available, but the reviewed sources do not establish when attacks stopped or how many servers were compromised.

What
Flaw
Affects
LiteSpeed user-end plugin for cPanel on web-hosting servers
Affected
LiteSpeed user-end cPanel plugin versions 2.3–2.4.4, according to LiteSpeed; the original flaw did not affect its WHM plugin.
Fixed in
LiteSpeed user-end cPanel plugin 2.4.5: original flaw fixed.
LiteSpeed user-end cPanel plugin 2.4.7, bundled with WHM plugin 5.3.1.0: vendor-recommended May security update.
CVE
CVE-2026-48172
Since
19 May 2026
Closed
22 Sept 2026

Timeline

  1. Update

    LiteSpeed released WHM plugin 5.3.6.0 with user-end plugin 2.4.10.0. These are the latest versions listed in its release log as checked for this record.

  2. New fix

    LiteSpeed released user-end plugin 2.4.8 with further protection against a reported flaw that let an authenticated cPanel user gain root privileges. The release log also records WHM updates 5.3.2.0 and 5.3.2.1.

  3. CISA added

    CISA added CVE-2026-48172 to its Known Exploited Vulnerabilities catalogue, with a 29 May remediation deadline for US federal civilian agencies.

  4. Made publicFixed

    LiteSpeed disclosed active exploitation of CVE-2026-48172, affecting user-end plugin versions 2.3–2.4.4. It said 2.4.5 fixed the original flaw and recommended 2.4.7, bundled with WHM plugin 5.3.1.0, after a broader security review.

  5. Update

    cPanel began automatically removing LiteSpeed’s user-end plugin during updates to prevent unauthorised root access. It said the LiteSpeed web service would continue working.

Sources

  1. Security Update for LiteSpeed cPanel PluginLiteSpeed Technologies · 21 May 2026
  2. Control Panel Plugins Release LogLiteSpeed Technologies · 22 Sept 2026
  3. Security: LiteSpeed plugin automatically removed during nightly update - May 19, 2026cPanel · 20 May 2026
  4. LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts as RootThe Hacker News · 23 May 2026
  5. Critical Vulnerability in LiteSpeed User-End cPanel PluginCyber Security Agency of Singapore · 26 May 2026
  6. CVE-2026-48172MITRE · 24 May 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from May 2026 · JSON · RSS