Secuno
ENNL
Book demo

CVE-2026-48172

LiteSpeed cPanel Plugin Privilege Escalation

9.8 CRITICALActively exploited (CISA KEV)EPSS 1.01%
  1. Published21 May 2026
  2. Added to CISA KEV26 May 2026
  3. Remediation due29 May 2026
Actively exploited (CISA KEV)

LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges.

Added to KEV: 26 May 2026Federal remediation due: 29 May 2026

Description

LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Litespeedtech Litespeed Cpanel Plugin< 2.4.7
Litespeedtech Litespeed Whm Plugin< 5.3.1.0

Remediation

Fixed in
Litespeedtech Litespeed Cpanel Plugin≥ 2.4.7
Litespeedtech Litespeed Whm Plugin≥ 5.3.1.0

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-620229.8
Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1…
CVE-2026-398019.8
Subscriber Privilege Escalation in AIWU <= 1.5.9…
CVE-2026-963418.2
Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows…
CVE-2026-1066109.8
Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification…
CVE-2026-955948.1
Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS…
CVE-2026-397758.8
Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2…

Frequently asked

Is CVE-2026-48172 being actively exploited?

Yes. CVE-2026-48172 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 26 May 2026.

How severe is CVE-2026-48172?

CVE-2026-48172 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 1.01% probability of exploitation.

Which products are affected by CVE-2026-48172?

Affected products include Litespeedtech Litespeed Cpanel Plugin, Litespeedtech Litespeed Whm Plugin.

How do I fix CVE-2026-48172?

Upgrade affected software to a fixed version, for example Litespeedtech Litespeed Cpanel Plugin 2.4.7, Litespeedtech Litespeed Whm Plugin 5.3.1.0 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-48172 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.