LiteSpeed cPanel Plugin CVE-2026-54420

Exploitation requires all of: (1) the target server is a shared hosting box running CloudLinux with CageFS enabled, (2) the LiteSpeed cPanel Plugin is installed at a version before 2.4.8 (or LiteSpeed WHM PlugIn before 5.3.2.0), and (3) the attacker already holds write access inside a tenant's CageFS root via FTP credentials or a previously planted web shell. Limiting factors that reduce real-world exposure: dedicated/VPS LiteSpeed deployments without CageFS are not affected, the attacker must be an authenticated tenant rather than an anonymous internet user, and CVSS AC:H reflects that triggering the privileged plugin to traverse the attacker-controlled path likely depends on either provoking a specific cPanel action or winning a race against the plugin's file operations.

The reported CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H gives 8.5 High, driven mainly by Scope:Changed and full CIA impact - the right call because cage escape crosses a security authority. AC:H and PR:L correctly capture that the attacker must already hold a tenant account and may need to win a race or hit a specific code path. The AV:N choice is questionable: although the FTP upload travels over the network, the actual vulnerable interaction is local symlink resolution on the host, so AV:L is more defensible and is reflected in my assessed vector. EPSS, KEV and POC fields are not provided; the CVE description's claim of May 2026 in-the-wild use is the only exploitation signal, so this should be treated as credible vendor-reported abuse against shared hosters rather than confirmed CISA KEV listing. Prioritize highly for any multi-tenant cPanel/CloudLinux operator; standalone or dedicated installs without CageFS are not in the vulnerable configuration.

An attacker buys a cheap account on a vulnerable shared hosting provider, or compromises an existing customer site via a weak WordPress password, gaining FTP or web-shell write access inside their CageFS. They replace a file the LiteSpeed cPanel plugin is known to read or write during routine cPanel actions with a symlink pointing at another tenant's wp-config.php or at /etc/shadow; when the plugin next touches that path it dereferences the link with its elevated privileges and returns the contents or overwrites the target, giving the attacker cross-tenant data theft and the ability to backdoor neighboring sites. No public POC is referenced in the provided data, but the CVE record states this pattern was exploited in May 2026.