LiteSpeed cPanel plugin flaws gave hosting accounts root access: ask your host

In May 2026, LiteSpeed Technologies published an urgent security update for its user-end cPanel plugin, the LiteSpeed component that appears inside cPanel on servers running LiteSpeed Web Server. The flaw, CVE-2026-48172, let any cPanel account abuse a Redis setting in the plugin to run scripts as root, the all-powerful administrator of the server. LiteSpeed said it was actively exploited. cPanel pushed a removal of the plugin on 19 May, and LiteSpeed released fixed versions on 19 and 21 May. CISA added it to its catalog of exploited vulnerabilities on 26 May 2026.

On 1 June 2026, LiteSpeed announced a second exploited flaw, later named CVE-2026-54420. On shared servers running CloudLinux and CageFS, a user with FTP or web shell access could use symbolic links to gain root. CISA added it to its catalog on 15 June 2026.

Root access to a shared server means access to every site and mailbox on it, so one weak or hacked account on the server could put your site at risk even if your own passwords are strong.

Who is affected

Servers using LiteSpeed's user-end cPanel plugin from version 2.3 up to versions before 2.4.8. The fix for the first flaw is in 2.4.7 (with WHM plugin 5.3.1.0), and the fix for the second is in 2.4.8 (released with WHM plugin 5.3.2.1). If you are on shared hosting, your host manages this plugin, not you.

How to check your site

• Log in to cPanel and look for a LiteSpeed section or icon. If there is one, your host uses this plugin and the question applies to you.
• Ask your host which version of the LiteSpeed cPanel plugin is installed and when it was updated.
• If you run your own VPS with cPanel and LiteSpeed, LiteSpeed gives this check for the first flaw, run as root. No output means no sign of that attack:

grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null

What to do now

1. Ask your host to confirm that the plugin is at 2.4.8 or later, or was removed, and whether they found signs of exploitation on your server.
2. On your own VPS, update the LiteSpeed WHM plugin to 5.3.2.1 or later, which also updates the cPanel plugin, as described in LiteSpeed's June post. If you cannot, uninstall the user-end plugin until you can.
3. If the check returns results, review the listed IP addresses and system logs, and contact LiteSpeed or your host for help.
4. If your host reports a compromise, change your cPanel, email, FTP and database passwords.

Hosts usually applied these updates quickly, and cPanel removed the plugin automatically at first, so most servers updated since June 2026 are likely protected, but it is worth asking. This alert reports what the sources listed below published and is not a guarantee about any specific site.