LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts as Root

A maximum-severity vulnerability (CVE-2026-48172, CVSS 10.0) in LiteSpeed cPanel Plugin is being actively exploited in the wild.

• •The flaw enables any cPanel user to execute arbitrary scripts with root privileges via the lsws.redisAble function
• •Affected versions range from 2.3 to 2.4.4; patch available in version 2.4.5
• •Users should upgrade to WHM Plugin 5.3.1.0 (which includes cPanel plugin v2.4.7 or higher)
• •An indicator of compromise using grep command is provided to detect exploitation attempts
• •As an interim measure, users can uninstall the user-end plugin using lscmctl

This summary was automatically generated by AI based on the original article and may not be fully accurate.