LiteSpeed User-End cPanel Plugin before 2

CVE-2026-48172 is an incorrect privilege assignment bug in the LiteSpeed User-End cPanel Plugin's Redis enable/disable path, specifically the lsws.redisAble function. LiteSpeed says versions 2.3 through 2.4.4 are at risk; LiteSpeed first patched it in 2.4.5, then pushed broader follow-up hardening in 2.4.6/2.4.7, with WHM plugin 5.3.1.0 bundling cPanel plugin 2.4.7. Successful abuse lets a cPanel user run arbitrary scripts as root on the host.

The vendor's 9.8/CRITICAL framing overstates the reachable attack surface because this is not actually PR:N in the real world. An attacker needs a valid cPanel account, a compromised tenant, or some other foothold on a shared host first. That said, the downgrade stops at HIGH, not lower, because this lands as root, hits an often internet-facing hosting stack, and is already KEV-listed with active exploitation.

Why this verdict

• Downgrade from 9.8: the published vector treats this like PR:N, but LiteSpeed explicitly says any cPanel user can exploit it. That is authenticated remote privilege escalation, not pure pre-auth internet RCE.
• Keep it HIGH: the privilege jump is straight to root, so one weak tenant or one stolen hosting credential can burn the entire server and every account on it.
• KEV overrides complacency: CISA KEV listing and vendor-confirmed exploitation mean attackers are already proving the prerequisite is easy enough in the field.

Why not higher?

I am not calling this CRITICAL because the main exposure gate is real and meaningful: the attacker must first land a valid cPanel user context on a server that both runs LiteSpeed and still has the vulnerable user-end plugin present. That narrows the reachable population substantially versus true unauthenticated edge RCEs like VPNs, firewalls, or pre-auth admin-panel bugs.

Why not lower?

I am not dropping this to MEDIUM because the outcome is root, not a limited user-context bug, and the target class is inherently internet-facing shared hosting where compromised tenant accounts are common enough to matter. KEV status removes the usual argument that the precondition is too theoretical.

1. Uninstall the user-end plugin — If you cannot prove every host is already on cPanel plugin 2.4.7 / WHM plugin 5.3.1.0 or later, remove the user-end plugin with LiteSpeed's uninstall path immediately, within hours because this CVE is actively exploited and KEV-listed. This is the cleanest temporary kill-switch for the vulnerable attack surface.
2. Disable auto-install — Set the LiteSpeed cPanel plugin auto-install state to off immediately, within hours so normal updates do not quietly reintroduce the user-end component on cleaned hosts. This matters in large fleets where image drift and nightly update behavior create re-exposure.
3. Restrict the cPanel feature list — Remove access to the LiteSpeed user-facing feature from packages that do not need it immediately, within hours. Even after patching, reducing the number of reachable tenants shrinks the post-compromise privilege-escalation path.
4. Hunt for redisAble log hits — Run the vendor grep across /var/cpanel/logs and /usr/local/cpanel/logs immediately, within hours. Any hit means you should treat the host as potentially compromised and investigate for root persistence, SSH keys, cron, and webshell artifacts.
5. Rotate secrets on hit systems — Where the grep or host review indicates possible abuse, rotate server- and tenant-level credentials immediately, within hours because root access means config secrets, database credentials, and SSH material may already be exposed.

Run this on each cPanel host as root. Save it as check-cve-2026-48172.sh and execute bash check-cve-2026-48172.sh; it needs root to read cPanel/LiteSpeed paths and logs. The script returns VULNERABLE, PATCHED, or UNKNOWN and exits 1, 0, or 2 respectively.

#!/usr/bin/env bash
# check-cve-2026-48172.sh
# Detect likely exposure to CVE-2026-48172 on a cPanel/LiteSpeed host.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

log_hits=0
plugin_present=0
cpanel_ver=""
whm_ver=""
status="UNKNOWN"
reason=""

ver_ge() {
  # returns 0 if $1 >= $2
  [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | head -n1)" = "$2" ]
}

ver_lt() {
  # returns 0 if $1 < $2
  ! ver_ge "$1" "$2"
}

# 1) Retrospective exploitation signal from vendor/NVD guidance
if grep -rEqs 'cpanel_jsonapi_func=redisAble' /var/cpanel/logs /usr/local/cpanel/logs 2>/dev/null; then
  log_hits=1
fi

# 2) Detect whether the user-end cPanel plugin looks installed
for d in \
  /usr/local/cpanel/base/frontend/jupiter/ls_web_cache_manager \
  /usr/local/cpanel/base/frontend/paper_lantern/ls_web_cache_manager \
  /usr/local/cpanel/base/frontend/*/ls_web_cache_manager; do
  if [ -d "$d" ]; then
    plugin_present=1
    break
  fi
done

# 3) Try to discover cPanel plugin version from likely files/paths
cpanel_ver=$(grep -RhoE '2\.[0-9]+(\.[0-9]+){1,2}' \
  /usr/local/cpanel/base/frontend/*/ls_web_cache_manager \
  /usr/local/cpanel/whostmgr/docroot/cgi/lsws \
  /usr/local/lsws 2>/dev/null | sort -V | tail -n1)

# 4) Try to discover WHM plugin version from likely files/paths
whm_ver=$(grep -RhoE '5\.[0-9]+(\.[0-9]+){1,2}' \
  /usr/local/cpanel/whostmgr/docroot/cgi/lsws \
  /usr/local/lsws 2>/dev/null | sort -V | tail -n1)

# 5) Decision logic
if [ "$log_hits" -eq 1 ]; then
  status="VULNERABLE"
  reason="Exploit indicator found in cPanel logs: cpanel_jsonapi_func=redisAble"
elif [ "$plugin_present" -eq 0 ]; then
  status="PATCHED"
  reason="User-end LiteSpeed cPanel plugin not found"
elif [ -n "$whm_ver" ] && ver_ge "$whm_ver" "5.3.1.0"; then
  status="PATCHED"
  reason="WHM plugin version appears to be $whm_ver (>= 5.3.1.0)"
elif [ -n "$cpanel_ver" ] && ver_ge "$cpanel_ver" "2.4.7"; then
  status="PATCHED"
  reason="cPanel plugin version appears to be $cpanel_ver (>= 2.4.7)"
elif [ -n "$cpanel_ver" ] && ver_lt "$cpanel_ver" "2.4.5"; then
  status="VULNERABLE"
  reason="cPanel plugin version appears to be $cpanel_ver (< 2.4.5)"
elif [ -n "$cpanel_ver" ] && { [ "$cpanel_ver" = "2.4.5" ] || [ "$cpanel_ver" = "2.4.6" ]; }; then
  status="UNKNOWN"
  reason="Found cPanel plugin version $cpanel_ver; vendor first fixed in 2.4.5 but later recommended 2.4.7 after additional review"
else
  status="UNKNOWN"
  reason="Could not reliably determine plugin version from host files"
fi

printf 'status=%s\n' "$status"
printf 'reason=%s\n' "$reason"
printf 'plugin_present=%s\n' "$plugin_present"
printf 'cpanel_plugin_version=%s\n' "${cpanel_ver:-not_found}"
printf 'whm_plugin_version=%s\n' "${whm_ver:-not_found}"
printf 'redisAble_log_hits=%s\n' "$log_hits"

case "$status" in
  PATCHED)
    echo "PATCHED"
    exit 0
    ;;
  VULNERABLE)
    echo "VULNERABLE"
    exit 1
    ;;
  *)
    echo "UNKNOWN"
    exit 2
    ;;
esac

Sources

1. NVD CVE-2026-48172
2. LiteSpeed vendor advisory
3. LiteSpeed control panel plugins release log
4. cPanel emergency removal notice
5. LiteSpeed cPanel plugin documentation
6. CISA KEV catalog entry
7. W3Techs LiteSpeed usage statistics
8. W3Techs cPanel usage statistics