LiteSpeed cPanel Plugin Privilege Escalation Vulnerability Advisory

Vulnerability Overview The LiteSpeed cPanel plugin contains a vulnerability that allows attackers to escalate privileges to root by accessing the plugin via FTP or a web shell. This vulnerability is being actively exploited, posing a risk to all affected plugin versions prior to 2.4.8. Affected Scope Affected Versions: All user-end plugin versions prior to 2.4.8. Affected Servers: Shared hosting servers running CloudLinux/CageFS. Remediation Steps 1. Upgrade the Plugin: - Upgrade to LiteSpeed WHM plugin v5.3.2.1, which bundles cPanel plugin v2.4.8 or higher. - Update the WHM plugin using the following command: 2. Uninstall the Plugin (if an upgrade is not possible): - Uninstall the user-end plugin using the following command: 3. Reinstall the Plugin (after updating the WHM plugin): - Reinstall the user-end plugin and enable autostart using the following commands: Detection Command Use the following command to check if the server is affected: If the command produces no output, the server is not affected. Timeline May 31, 2026: Received the original vulnerability report. May 31, 2026: cPanel released the command for the user-end plugin. June 1, 2026: Released cPanel plugin v2.4.8 and WHM plugin v5.3.2.1. June 1, 2026: Applied for a CVE ID. Conclusion We thank Namecheap for reporting the original issue and thank the cPanel team for taking swift action to prevent further exploitation. It is recommended that all users update their cPanel plugins immediately.

Goal Reached Thanks to every supporter — we hit 100%!

LiteSpeed cPanel Plugin Privilege Escalation Vulnerability Advisory