TI-2026-35606 Aliases CVE-2026-48172 GHSA-fxrh-cwjh-m33v

LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to…

CRITICAL 100Exploited in the wildCWE-266Published 2026-05-21 · Updated 2026-10-07

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Privilege escalation
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-266.

Summary

LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.

Why it matters now

Exploitation Active In CISA KEV since 2026-05-26CISA due date 2026-05-29

EPSS 0.17915 97th percentileScored 2026-11-07

Fix Fixed cPanel Plugin (LiteSpeed Technologies): 2.4.7WHM Plugin (LiteSpeed Technologies): 5.3.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Active
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
LiteSpeed Technologies	cPanel Plugin	2.3 to before 2.4.7	2.4.7	Patch available	CNA
LiteSpeed Technologies	WHM Plugin	before 5.3.1.0	5.3.1.0	Patch available	CNA

cPanel Plugin VendorLiteSpeed Technologies Affected 2.3 to before 2.4.7 Fixed in 2.4.7 Patch available CNA
WHM Plugin VendorLiteSpeed Technologies Affected before 5.3.1.0 Fixed in 5.3.1.0 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:litespeedtech:litespeed_cpanel_plugin::::::::	before 2.4.7	Vulnerable	litespeedtech
cpe:2.3:a:litespeedtech:litespeed_whm_plugin::::::::	before 5.3.1.0	Vulnerable	litespeedtech

cpe:2.3:a:litespeedtech:litespeed_cpanel_plugin:*:*:*:*:*:*:*:* Versions before 2.4.7 Vulnerable ·litespeedtech
cpe:2.3:a:litespeedtech:litespeed_whm_plugin:*:*:*:*:*:*:*:* Versions before 5.3.1.0 Vulnerable ·litespeedtech

Remediation

Fix · CNA cPanel Plugin (LiteSpeed Technologies) Fixed in 2.4.7
Fix · CNA WHM Plugin (LiteSpeed Technologies) Fixed in 5.3.1.0

Timeline

2026-05-26 Added to CISA KEV
2026-10-02 Threatist record created from CVE-2026-48172
2026-10-03 Alias added: GHSA-fxrh-cwjh-m33v
2026-10-07 CISA SSVC decision points changed
2026-10-25 EPSS moved to the 95th–99th percentile

References

Advisory 1

https://blog.litespeedtech.com/2026/05/21/security-update-for-litespeed-cpanel-plugin/

Other 2

TI-2026-39296 LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before… KEVCVSS 3.1HIGH 8.5
TI-2024-29589 WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability CVSS 3.1CRITICAL 9.8
TI-2024-18601 WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability CVSS 3.1CRITICAL 9.8
TI-2022-00030 Authenticated Remote Code Execution in OpenLiteSpeed Web Server CVSS 3.1HIGH 8.8
TI-2021-22517 LiteSpeed Web Server Enterprise 5.4.11 - Command Injection CVSS 4.0HIGH 8.6
TI-2023-20892 WordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Site Wide Stored XSS vulnerability CVSS 3.1HIGH 8.3

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences