CVE-2026-48172: LiteSpeed cPanel Plugin -- Root Privilege Escalation via redisAble API

Background

LiteSpeed Web Server is widely deployed in shared hosting environments, particularly through cPanel/WHM-based hosting platforms. The LiteSpeed cPanel Plugin provides user-facing controls that allow individual cPanel account holders to manage LiteSpeed features affecting their hosting account — cache configuration, Redis integration, and related settings — without requiring root-level WHM access.

CVE-2026-48172 is a critical privilege escalation vulnerability (CVSS 10.0) in the user-end component of this plugin. Any authenticated cPanel user — including low-privilege shared hosting accounts — can exploit this vulnerability to execute arbitrary scripts with root privileges on the underlying server. CISA added CVE-2026-48172 to the Known Exploited Vulnerabilities catalogue on 26 May 2026, with a remediation deadline of 29 May 2026 under BOD 22-01. Active exploitation is confirmed in the wild, with opportunistic attacks targeting web hosting infrastructure.

Technical Mechanism

Root cause: The vulnerability originates in the lsws.redisAble function within the LiteSpeed User-End cPanel Plugin. This function was intended to allow individual cPanel users to enable or disable Redis caching for their account. The function is accessible to any authenticated cPanel user via the cPanel plugin API.

The root cause is a missing authorisation boundary: the function executes server-side operations to manage Redis service state without verifying that the calling user’s privileges are appropriate for those operations. The underlying process handling the request runs with elevated privileges. By invoking this function through the standard cPanel JSONAPI interface, an attacker can pass arbitrary script content that executes in the context of those elevated privileges.

The vulnerability is classified as CWE-266 (Incorrect Privilege Assignment) — the plugin grants the calling user’s request execution rights that exceed what their cPanel role authorises.

Exploitation mechanics: Exploitation is straightforward and requires only a valid cPanel user account on the target server. The attack targets the standard cPanel JSONAPI endpoint:

POST /execute/LiteSpeed/redisAble HTTP/1.1

The cpanel_jsonapi_func=redisAble parameter invokes the vulnerable function. By crafting the request with appropriate payload content, an attacker causes arbitrary script execution under the root-privileged server process.

No additional vulnerabilities, privilege elevation steps, or special account types are required. A standard shared hosting cPanel account — obtainable for a few dollars on any affected hosting provider — is sufficient to compromise the entire underlying server and all hosted accounts on it.

Exploitation chain from shared hosting to full server compromise:

1. Attacker creates or purchases a shared hosting account with cPanel access on a target server running affected LiteSpeed plugin versions
2. Attacker sends crafted API request invoking the redisAble function with malicious payload
3. Payload executes as root, enabling arbitrary file write, code execution, and persistence
4. Attacker has full control of the server and all cPanel accounts hosted on it

The CVSS 10.0 rating reflects the combination of: no authentication beyond a standard user account, network-accessible attack surface, and complete system compromise impact.

Real-World Exploitation Evidence

CISA’s addition to the KEV catalogue on 26 May 2026 reflects confirmed in-the-wild exploitation. Public reporting from security vendors and hosting security researchers documents opportunistic attacks beginning before the vendor patch was published on 21 May 2026.

Observed post-exploitation activity:

• Webshell deployment — PHP webshells written to accessible web directories for persistent access
• Lateral access across hosted accounts — extraction of credential files, database passwords, and configuration data from co-hosted customer accounts
• Cryptominer deployment — XMRig and similar miners installed as root-level processes, affecting server performance
• Data exfiltration — customer databases, email content, and SSL private keys extracted from compromised hosting environments

The attack profile is consistent with opportunistic financially-motivated actors who scan for vulnerable cPanel-based hosting infrastructure at scale. The trivial exploitation barrier — a paid shared hosting account — lowers the cost of access dramatically compared to vulnerabilities requiring unauthenticated network access.

Hosting providers are particularly exposed: a single vulnerable WHM server can host hundreds or thousands of customer cPanel accounts, all of which are effectively compromised when root access is obtained.

Impact Assessment

Any authenticated cPanel user on an affected hosting server can achieve root access on the underlying system. In shared hosting environments, a standard hosting account costing a few dollars per month provides the attack primitive — no insider access or prior privilege is required.

Root access exposes all co-hosted tenants on the same server: their files, databases, SSL private keys, email content, and configuration data. Hosting providers face significant reputational and legal liability when customer data across their entire infrastructure is exfiltrated in a single attack. The cascading nature — one low-privilege user account to root to all tenants — makes this among the most operationally damaging privilege escalation patterns in shared hosting environments.

Affected Versions

Installations running LiteSpeed WHM plugin 5.3.1.0 or later contain the patched user-end plugin and are not affected.

Remediation Steps

Primary: Upgrade the plugin. Update to LiteSpeed User-End cPanel Plugin version 2.4.7 or later, delivered as part of WHM Plugin 5.3.1.0. Follow the standard LiteSpeed plugin update procedure through WHM:

WHM → Plugins → LiteSpeed Web Server → Update Plugin

Or via CLI:

/usr/local/lsws/admin/misc/lscmctl cpanelplugin --update

Verify the installed version after update:

/usr/local/lsws/admin/misc/lscmctl cpanelplugin --version

Version 2.4.7 or higher in the output confirms the patched release.

Interim mitigation: Uninstall the user-end plugin. If immediate upgrade is not possible, uninstall the user-end cPanel plugin entirely. This removes the vulnerable component while the LiteSpeed server itself continues operating normally. Users lose access to plugin-managed features (Redis configuration) until the plugin is reinstalled in patched form.

/usr/local/lsws/admin/misc/lscmctl cpanelplugin --uninstall

Post-compromise response. If exploitation is suspected or confirmed:

1. Isolate the server from the network pending forensic review
2. Audit all cPanel accounts for unauthorised files — webshells, miner binaries, modified configuration files
3. Rotate all credentials stored on the server: database passwords, SSL private keys, API credentials, email passwords
4. Notify hosted customers of potential compromise — their data was accessible to any attacker with root access
5. Review server logs for privilege escalation activity and exfiltration indicators
6. Rebuild from known-clean state where possible; patching an already-compromised server is insufficient

Detection Guidance

Log-based detection. The primary indicator is unexpected invocation of the redisAble API function, particularly from user accounts that have no business reason to toggle Redis settings:

grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs/ /usr/local/cpanel/logs/ 2>/dev/null

Any output from this query warrants review. Correlate the associated cPanel usernames and source IP addresses against expected activity patterns.

Additional log sources to review:

• /var/log/wtmp / last — unusual root login activity
• /var/log/secure — sudo and su usage anomalies
• cPanel API access logs — bulk API calls from unusual source IPs or during off-hours
• LiteSpeed server logs — unusual process spawns associated with web requests
• Filesystem audit logs — new executables, webshells, or scripts in web-accessible directories

Host-based indicators:

• Unexpected processes running as root, particularly xmrig, kswapd0, or similarly-named cryptominer masquerades
• New PHP files in cPanel public_html directories not corresponding to normal deployments
• Unexpected cron jobs added for root or individual cPanel users
• Modified SSH authorized_keys files

Network indicators:

• Outbound connections from the server to mining pool domains or IP ranges
• Unusual outbound traffic on non-standard ports established by Java, PHP-FPM, or web server processes
• DNS queries for domains associated with known cryptominer command-and-control infrastructure

Timeline

References

• NVD — CVE-2026-48172
• CISA KEV — CVE-2026-48172
• MITRE CVE — CVE-2026-48172