CVE-2026-48172

The vulnerability stems from improper handling of Redis enable/disable functions in the cPanel API component. An attacker can abuse the 'cpanel_jsonapi_func=redisAble' parameter to obtain elevated system privileges. The error is classified as CWE-266 (improper privilege management). The exploit requires no authentication or user interaction, making it particularly dangerous.

An attacker can obtain elevated privileges on the system, potentially up to root level, which grants full control over the server. This enables reading and modifying data, installing malicious software, and further lateral movement within the infrastructure.

Immediately update the LiteSpeed User-End cPanel Plugin to version 2.4.7 or later. The vendor also recommends verifying whether the system was targeted by executing the command: grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null — no results indicate no exploitation. If results are detected, analyze associated IP addresses, block invalid/suspicious ones, and review system logs for activity from detected addresses.

LiteSpeed User-End cPanel Plugin in versions prior to 2.4.5 (recommended minimum secure version: 2.4.7)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges.