The vulnerability allows an attacker to elevate privileges, possibly to root, by exploiting improper handling of Redis enable/disable commands in the LiteSpeed User‑End cPanel Plugin before version 2.4.5. Detection is performed by searching for the keyword 'cpanel_jsonapi_func=redisAble' in cPanel logs; absence of the string indicates no exploitation, while its presence suggests the plugin’s Redis feature was abused. The flaw is a CWE‑266 privilege‑escalation vulnerability that was actively exploited in May 2026.

Affected products include the LiteSpeed Technologies cPanel Plugin before version 2.4.5 and the LiteSpeed WHM PlugIn before version 5.2.10. Users should verify that their cPanel installation is version 2.4.5 or newer, and that the WHM PlugIn is at least version 5.2.10.

The CVSS score is 10.0, reflecting critical severity. The EPSS score is <1%, indicating a low exploitation probability, yet the vulnerability has been actively exploited in May 2026 and is not listed in the CISA KEV catalog. The direct attack vector is not explicitly defined in the vendor notes, but detection via logs suggests that the exploit requires an attacker to trigger or observe the plugin’s Redis commands, which could be achieved through a compromised cPanel session or a script that invokes the API. Given the high severity and active exploitation, the risk to systems remains extreme.