LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts as Root

A critical vulnerability in the LiteSpeed User-End cPanel Plugin has been disclosed and is already under active exploitation in the wild. Tracked as CVE-2026-48172 with a maximum CVSS score of 10.0, the flaw allows attackers to run arbitrary scripts with root-level permissions — effectively enabling full server compromise on any affected cPanel hosting environment.

Vulnerability Details

The vulnerability stems from incorrect privilege assignment in the LiteSpeed cPanel Plugin's script execution mechanism. The plugin, which integrates the LiteSpeed Web Server with cPanel's user management system, fails to properly restrict the privilege level at which certain operations are executed.

An attacker who can interact with the affected component can submit specially crafted requests that cause the plugin to execute arbitrary scripts in the context of the root user — bypassing all normal user-level restrictions enforced by cPanel and the underlying operating system.

CVE Details:

• CVE ID: CVE-2026-48172
• CVSS Score: 10.0 (Critical)
• Affected Component: LiteSpeed User-End cPanel Plugin
• Impact: Arbitrary script execution as root / full system compromise
• Authentication Required: Unconfirmed — initial reports suggest low-privileged access may be sufficient

Active Exploitation

The vulnerability is confirmed under active exploitation. Threat intelligence reports indicate exploitation attempts began within hours of the initial disclosure, with attackers deploying:

• Web shells for persistent backdoor access
• Cryptocurrency miners leveraging full CPU access enabled by root execution
• Credential harvesters targeting stored cPanel passwords and SSH keys
• Lateral movement tools to pivot to other servers on shared hosting platforms

Shared hosting environments are at elevated risk given that a single compromised server can expose hundreds or thousands of hosted websites to attackers operating with root access.

Affected Versions

All versions of the LiteSpeed User-End cPanel Plugin prior to the patched release are believed to be affected. Administrators should check their installed version immediately and cross-reference against LiteSpeed's security advisory.

To check your installed plugin version:

# Check LiteSpeed cPanel plugin version
/usr/local/cpanel/3rdparty/lsphp/bin/php -r "echo phpversion();"
 
# Or check via WHM
whmapi1 get_installed_plugins | grep -i litespeed

Remediation

LiteSpeed has released an emergency patch addressing CVE-2026-48172. Administrators should:

1. Update immediately — apply the latest LiteSpeed cPanel Plugin update via WHM's Plugin Manager or directly from LiteSpeed's repository
2. Audit for compromise — review server logs for unusual root-level script executions, unexpected cron jobs, and new user accounts
3. Check for web shells — scan web directories for recently modified PHP files and known web shell signatures
4. Rotate credentials — change all cPanel account passwords and SSH keys hosted on affected servers
5. Review network connections — look for outbound connections to unknown external hosts that may indicate active command-and-control communication

# Quick check for recently modified PHP files (potential web shells)
find /home -name "*.php" -newer /etc/passwd -type f 2>/dev/null | head -50
 
# Check for new cron jobs (potential persistence)
for user in $(cut -d: -f1 /etc/passwd); do crontab -l -u $user 2>/dev/null | grep -v "^#" | grep -v "^$" && echo "--- $user ---"; done
 
# Check running processes owned by root that aren't standard
ps aux | grep ^root | grep -v "\[" | awk '{print $11}' | sort | uniq

Hosting Provider Actions Required

Shared hosting providers running LiteSpeed with cPanel should treat this as a critical emergency:

• Emergency patch deployment should be prioritized above all other maintenance
• Proactive customer notification is strongly recommended given the potential for cross-account compromise
• Log review should be conducted for all servers in the affected fleet to identify exploitation attempts
• Incident response should be initiated for any servers showing indicators of compromise

Context

LiteSpeed Web Server is widely deployed in the shared hosting industry, often positioned as a high-performance alternative to Apache with direct cPanel integration. The cPanel ecosystem serves millions of websites globally, making any critical vulnerability in LiteSpeed's cPanel integration a high-impact event.

This vulnerability follows a pattern of privilege escalation flaws in hosting control panel integrations — a reminder that the attack surface of web hosting infrastructure extends well beyond the web application layer into the management plane.

Administrators are strongly urged to apply the patch immediately and treat any delay as an unacceptable risk given confirmed active exploitation.