CVE-2026-48172
The LiteSpeed User‑End cPanel Plugin before version 2.4.5 can be exploited to gain higher privileges, possibly root, on affected servers. The flaw is due to improper handling of Redis enable/disable features and has been used in the wild. Upgrading to version 2.4.7 or later resolves the issue.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
LiteSpeed User‑End cPanel Plugin and LiteSpeed WHM Plugin, any installation using a version earlier than 2.4.5. Typical users are web‑hosting administrators who run LiteSpeed with cPanel.
Real-world impact
An attacker who exploits this flaw can elevate their privileges to root, allowing them to read, modify, or delete any file on the server, install malware, or disrupt services.
Why this severity
The CVSS score of 10 reflects the vulnerability’s ability to give an attacker full control over the system (confidentiality, integrity, and availability are all compromised) with no authentication or user interaction required.
What to do about it
- 01Upgrade the LiteSpeed cPanel Plugin to version 2.4.7 or later.
- 02Restart the LiteSpeed service to apply the update.
- 03Verify the plugin version to confirm the upgrade was successful.
NVD-referenced vendor advisory
Timeline
- May 21, 2026 · May 21, 2026PublishedDisclosed and added to the National Vulnerability Database.
- May 26, 2026 · May 26, 2026Confirmed exploited (CISA KEV)CISA added it to the Known Exploited Vulnerabilities catalog — attackers are using it in the wild.
- May 29, 2026 · May 29, 2026CISA remediation deadlineFederal agencies are required to remediate by this date.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 23, 2026 · 12d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- blog.litespeedtech.com/2026/05/21/security-update-…vendor advisory
- litespeedtech.com/products/litespeed-web-serv…product
- litespeedtech.com/products/litespeed-web-serv…release notes
- cisa.gov/known-exploited-vulnerabili…us government resource