LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.
| Vendor | Product | Versions |
|---|---|---|
| litespeedtech | litespeed_cpanel_plugin | 2.3, 0 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| litespeedtech | litespeed_whm_plugin | cve_cpe | 95% |
Loading…
Updated description with technical details, changed severity to HIGH, added affected versions 2.4.5, 2.4.6, 2.4.7, and updated patch available to 2.4.8.
Updated severity to CRITICAL, CVSS score to 9.8, and added affected versions 2.4.0 to 2.4.4 along with a more detailed description.
Updated severity to CRITICAL, CVSS score to 9.8, added affected version 2.4.4, and included a more detailed description of the vulnerability.
Updated severity to CRITICAL, CVSS score to 10.0, and marked exploit as available.
Updated description with new technical details, changed severity to HIGH, marked as actively exploited, and noted that no exploit is available.
Initial creation
