Critical · published May 21, 2026
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 62.8th percentile for exploit probability.
🚨 A privilege escalation vulnerability in the LiteSpeed User-End cPanel Plugin could let attackers gain root access—yes, you read that right! 🔥 Think of it like an unauthorized guest sneaking into the staff area of a restaurant, where they can access the kitchen secrets and control the entire operation—disastrous, right? An attacker exploiting this vulnerability can gain full control over your server, leading to potentially catastrophic data breaches, unauthorized access, or even complete system takeover. The implications could be absolutely devastating if sensitive information is exposed or manipulated!
Think of it like an unauthorized guest sneaking into the staff area of a restaurant, where they can access the kitchen secrets and control the entire operation—disastrous, right? This flaw in versions before 2.4.5 arises from improper handling of Redis features, allowing privilege escalation that could grant root access to malicious users. The vulnerability has already been exploited in the wild, making it urgent to address.
An attacker exploiting this vulnerability can gain full control over your server, leading to potentially catastrophic data breaches, unauthorized access, or even complete system takeover. The implications could be absolutely devastating if sensitive information is exposed or manipulated! Immediately update the LiteSpeed User-End cPanel Plugin to version 2.4.7 or later. Run the command `grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null` to check if your system has been targeted, and block any suspicious IP addresses. Take a moment to review your system logs for unusual activity—this is crucial! You've got this! With these steps, you'll lock down your server and stand strong against this threat! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| litespeedtech/litespeed_cpanel_plugin | < 2.4.7 | 2.4.7 |
| litespeedtech/litespeed_whm_plugin | < 5.3.1.0 | 5.3.1.0 |