Lite Speed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts as Root
Summary: LiteSpeed's User-End cPanel Plugin carries CVE-2026-48172, a CVSS 10.0 incorrect privilege assignment flaw that lets any cPanel user, including an attacker or a compromised account, call the lsws.redisAble function to run arbitrary scripts as root. The flaw affects plugin versions 2.3 through 2.4.4, is fixed in 2.4.5, and LiteSpeed says it is being actively exploited; CISA added it to the KEV catalog on May 26, 2026, with a May 29, 2026 fix deadline for FCEB agencies.
Key Takeaway: A single compromised cPanel account is enough to reach root on the server, and the fix LiteSpeed ultimately points to is WHM plugin 5.3.1.0 bundled with cPanel plugin 2.4.7 or higher, not the 2.4.5 release that first closed the reported flaw.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-41940CVE-2026-48172
- Related