LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts as Root

A maximum-severity flaw (CVE-2026-48172, CVSS 10.0) in the LiteSpeed User-End cPanel Plugin is under active exploitation. The bug is an incorrect privilege assignment: any cPanel user — including a low-privilege account or a compromised one — can invoke the plugin to execute arbitrary scripts as root.

Shared hosting environments are the primary attack surface, as cPanel is ubiquitous there. A single compromised tenant account is enough to fully compromise the underlying host. Operators should patch the LiteSpeed plugin immediately and audit recent privilege-escalation activity in cPanel audit logs.