LiteSpeed cPanel Plugin EUVD-2026-31204

Exploitation targets the LiteSpeed User-End cPanel Plugin specifically (the WHM parent plugin is not vulnerable) and works only on versions 2.3 through before 2.4.5. The concrete trigger is the plugin's Redis enable/disable feature, invoked via the cPanel JSON API function redisAble (cpanel_jsonapi_func=redisAble) - this is the exact feature/endpoint whose mishandling grants escalation to (possibly) root. Limiting factors: the endpoint is part of cPanel's end-user API, so realistic exploitation most likely requires the ability to reach and call that authenticated cPanel user API (the vendor's CVSS marks PR:N, but the redisAble jsonapi path implies at least a low-privileged hosting account - authentication requirement should be confirmed with the vendor); the target must be a cPanel server running the affected end-user plugin with the Redis feature present. No special non-default configuration or user interaction beyond calling the vulnerable function is indicated.

This is a genuine top-priority issue, not a high-CVSS paper tiger: it is confirmed actively exploited (CISA KEV), has publicly available exploit code, and SSVC rates technical impact as total and the vulnerability as automatable - all consistent with the vendor's CVSS 4.0 base score of 10.0 (AV:N/AC:L/PR:N/UI:N with high impact to both vulnerable and subsequent systems). The signals do conflict in two places that defenders should note. First, EPSS is only 0.04% (12th percentile), which is low; combined with KEV this suggests targeted rather than mass-scanning exploitation to date, rather than absence of risk. Second, the SSVC field lists Exploitation as 'none' even though the record is KEV-listed and a PoC exists - this is a data inconsistency in the feed, and the KEV/PoC evidence should take precedence. Additionally, the CVSS PR:N (unauthenticated) rating is worth verifying: the exploit path runs through cPanel's end-user JSON API (redisAble), which typically implies at least a low-privileged cPanel account, so real-world exploitation may require an authenticated hosting user escalating to root - verify with the vendor advisory.

An attacker with access to the cPanel end-user JSON API invokes the plugin's redisAble (Redis enable/disable) function in a crafted way that, due to incorrect privilege assignment, executes actions at elevated privilege and yields root-level control of the shared hosting server. Public exploit code exists (including a GitHub PoC at github.com/HORKimhab/CVE-2026-48172), and low attack complexity with automatable exploitation makes this straightforward to weaponize against unpatched hosts.