LiteSpeed cPanel Plugin Flaw Hands Root to Any Logged-In User, and the Vendor Won't Say How Many Hosts Are Hit
CVE-2026-48172 carries a CVSS of 10.0, is already being exploited, and LiteSpeed has not answered three questions about exploitation telemetry.
Key points
- A privilege-assignment bug in the LiteSpeed User-End cPanel Plugin lets any authenticated cPanel user run arbitrary scripts as root.
- CVE-2026-48172 scores a maximum 10.0 on CVSSv3 and is being actively exploited.
- LiteSpeed's public advisory doesn't name a specific fixed build, making patching verification harder for downstream providers.
- CISA hasn't added CVE-2026-48172 to its Known Exploited Vulnerabilities catalog as of this writing.
- Three reseller networks contacted for this story didn't return comment on their patch status.
What does the bug actually do?
A privilege-assignment flaw in the LiteSpeed User-End cPanel Plugin is being exploited to run arbitrary scripts as root on shared hosting servers. The plugin handles server-side actions as root by design, to manage cache files outside a user's home directory. It doesn't adequately gate which scripts a calling user may trigger, so a low-privilege account, whether purchased cheaply on a reseller plan or taken over through a stolen password, becomes a root shell. That's not a theoretical escalation path: shared hosting is the natural habitat of credential-stuffed cPanel logins.
What has LiteSpeed said?
Not enough. The company's advisory tells administrators to update to the latest plugin build but doesn't name a CVE-fixed version in the bulletin's body, which makes it harder for hosting providers to confirm whether their fleet is patched. LiteSpeed's marketing pages describe the plugin as bundled with millions of cPanel accounts; the advisory doesn't repeat that figure, and the company didn't respond to three separate emails asking how many servers run the affected plugin, when it first received exploitation reports, and whether the fixed build is being pushed automatically. No reply came before publication.
Should you worry if your host runs cPanel on LiteSpeed?
Yes, particularly if you're a reseller or buying accounts from one. The plugin ships enabled by default on LiteSpeed Web Server and OpenLiteSpeed installations that opted into cPanel integration, and many resellers don't know which plugins their upstream provider has turned on. NameHero, Hostinger and A2 Hosting didn't return requests for comment on their patch status. That's the uncomfortable reality here: the population most at risk isn't LiteSpeed's direct customers, it's the tenants several layers down who have no visibility into what's running on the hardware beneath them.
Where does the federal response stand?
CISA hasn't added CVE-2026-48172 to its Known Exploited Vulnerabilities catalog as of this writing. A spokesperson declined to say whether a review is underway, citing the agency's policy on pending entries. Until it does appear there, federal agencies aren't formally required to act, but any host running the affected plugin shouldn't wait for that designation before patching.
Who is exploiting this and since when? LiteSpeed hasn't said, and no one else has gone on the record. The vendor's silence on exploitation telemetry is the detail worth watching: a 10.0-severity plugin flaw with confirmed in-the-wild use is exactly the scenario where customer-facing transparency matters most, and it isn't there yet.
