Research · May 20, 2026 · ZeroDay Catalog
Privilege Escalation Vulnerability in LiteSpeed cPanel Plugin
A critical privilege escalation vulnerability has been identified in the LiteSpeed cPanel Plugin, allowing potential root access. Immediate action is required to mitigate risks.
What changed
A privilege escalation vulnerability has been discovered in the LiteSpeed User-End cPanel Plugin prior to version 2.4.5. This flaw allows unauthorized users to potentially gain root access, posing significant security risks.
The vulnerability has been actively exploited in the wild since May 2026, necessitating urgent attention from affected users.
Who is affected
The vulnerability impacts users of the LiteSpeed cPanel Plugin, particularly those running versions before 2.4.5.
Organizations utilizing LiteSpeed for web hosting and management are at risk, especially if they have not updated to the latest version.
- LiteSpeed cPanel Plugin users
- Web hosting providers using LiteSpeed technology
- System administrators managing cPanel environments
- Organizations relying on Redis for application performance
What to do
It is crucial to update the LiteSpeed cPanel Plugin to version 2.4.5 or later to mitigate this vulnerability. Regular updates can significantly reduce the risk of exploitation.
Additionally, users should conduct thorough log examinations to identify any unauthorized access attempts and take appropriate actions against suspicious IP addresses.
- Upgrade to LiteSpeed cPanel Plugin version 2.4.5 or later immediately.
- Run the command line check to detect potential exploitation: grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null.
- Investigate any output from the command to identify and block malicious IP addresses.
- Review system logs for any unauthorized activities linked to detected IP addresses.