[URGENT] Security Advisory Update — LiteSpeed cPanel Plugin (Action Required)

[Jade @ Absolute Hosting]

A fix is now available for a serious privilege-escalation vulnerability in the LiteSpeed User-End cPanel Plugin.

Vulnerability Summary​

Any cPanel user (including an attacker or a compromised account) could exploit the lsws.redisAble function to execute arbitrary scripts as root. This issue is being actively exploited in the wild.

Recommended Action​

We strongly recommend you urgently upgrade to:

LiteSpeed WHM Plugin v5.3.0 (bundled w/ cPanel plugin v2.4.6).

Alternative: Uninstall the Vulnerable Plugin​

If you cannot upgrade immediately, please run the following command as root to remove the plugin:

Bash

/usr/local/lsws/admin/misc/lscmctl cpanelplugin --uninstall


This will remove the vulnerable User-End plugin from existing accounts and prevent it from being installed on new accounts.

Note: The cPanel team is also assisting by pushing a one-time uninstall command across cPanel servers where the LiteSpeed User-End plugin is detected.

How to Check If Your Server Has Been Exploited​

To verify whether your server has been affected, run:

Bash


grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null

• No results → Your server is clean.
• Any output → Please copy the results and contact our support team immediately.

Quick Reference​

• Affected: LiteSpeed User-End cPanel Plugin
• Not affected: LiteSpeed WHM Plugin (the parent plugin)

Please take action as soon as possible to secure your servers. If you need assistance with the upgrade or uninstall process, our support team is ready to help.