TI-2026-39296 Aliases CVE-2026-54420 GHSA-3g44-c4qc-cxm8

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before…

CRITICAL 96Exploited in the wildCWE-61Published 2026-06-14 · Updated 2026-06-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.

Why it matters now

Exploitation Active In CISA KEV since 2026-06-15CISA due date 2026-06-18

EPSS 0.01439 73rd percentileScored 2026-11-07

Fix Fixed cPanel Plugin (LiteSpeed Technologies): 2.4.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Active
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
LiteSpeed Technologies	cPanel Plugin	2.3 to before 2.4.8	2.4.8	Patch available	CNA

cPanel Plugin VendorLiteSpeed Technologies Affected 2.3 to before 2.4.8 Fixed in 2.4.8 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:litespeedtech:litespeed_cpanel_plugin::::::::	before 2.4.8	Vulnerable	litespeedtech
cpe:2.3:a:litespeedtech:litespeed_whm_plugin::::::::	before 5.3.2.0	Vulnerable	litespeedtech

cpe:2.3:a:litespeedtech:litespeed_cpanel_plugin:*:*:*:*:*:*:*:* Versions before 2.4.8 Vulnerable ·litespeedtech
cpe:2.3:a:litespeedtech:litespeed_whm_plugin:*:*:*:*:*:*:*:* Versions before 5.3.2.0 Vulnerable ·litespeedtech

Remediation

Fix · CNA cPanel Plugin (LiteSpeed Technologies) Fixed in 2.4.8

Timeline

2026-06-15 Added to CISA KEV
2026-10-02 Threatist record created from CVE-2026-54420
2026-10-03 Alias added: GHSA-3g44-c4qc-cxm8

References

Advisory 1

https://blog.litespeedtech.com/2026/06/01/security-update-for-litespeed-cpanel-plugin-2/

Other 1

https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/cpanel

TI-2026-35606 LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to… KEVCVSS 4.0CRITICAL 10.0
TI-2024-29589 WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability CVSS 3.1CRITICAL 9.8
TI-2024-18601 WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability CVSS 3.1CRITICAL 9.8
TI-2022-00030 Authenticated Remote Code Execution in OpenLiteSpeed Web Server CVSS 3.1HIGH 8.8
TI-2021-22517 LiteSpeed Web Server Enterprise 5.4.11 - Command Injection CVSS 4.0HIGH 8.6
TI-2023-20892 WordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Site Wide Stored XSS vulnerability CVSS 3.1HIGH 8.3

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences