LiteSpeed User-End cPanel Plugin Privilege Escalation: The Actively-Exploited Bug That Got Auto-Uninstalled in cPanel's May 19, 2026 Emergency Patch

On May 19, 2026, cPanel released an emergency security update approximately 12 hours ahead of its originally scheduled May 20 publication date. The reason for the acceleration: an actively-exploited privilege-escalation vulnerability in the LiteSpeed User-End cPanel Plugin, a third-party plugin from LiteSpeed Technologies that provides cPanel users with an interface to manage LiteSpeed Cache settings. The vulnerability allowed unauthorized root access on affected servers and was being abused in real attacks before the patch was available.

cPanel's response was unusual. Rather than wait for LiteSpeed Technologies to ship a patched version of the plugin, cPanel included an automated fix in this release that uninstalls the plugin entirely on update. Servers that ran the plugin no longer have it after applying the May 19 release. This is the third cPanel emergency security release in just over three weeks, following the CVE-2026-41940 authentication bypass on April 28 and the May 13 patch covering five additional CVEs.

If you are a Gotekky managed cPanel customer, the patch is deploying across our fleet today. The automated uninstall of the LiteSpeed User-End plugin has taken effect on managed servers where it was installed. No compromise indicators have been observed on managed servers during the exposure window. The rest of this guide explains what the vulnerability is, what the auto-uninstall means for cPanel users, what to verify if you operate self-managed cPanel servers, and how to continue managing LiteSpeed Cache without the plugin.

What the LiteSpeed User-End cPanel Plugin actually is

The naming around LiteSpeed products causes confusion even among experienced operators, so worth being precise. The LiteSpeed User-End cPanel Plugin is the plugin that LiteSpeed Technologies ships for cPanel that gives end users (cPanel account holders, not the server admin) a graphical interface inside their cPanel panel to manage LiteSpeed Cache settings for their websites. The plugin appears as an icon in the cPanel interface, typically labeled "LiteSpeed Web Cache Manager" or similar.

It is distinct from several other LiteSpeed products that share related names:

• LiteSpeed Web Server (LSWS) is the actual web server software that serves websites. It is not affected by this vulnerability and is not being uninstalled.
• LiteSpeed Cache for WordPress (LSCWP) is the WordPress plugin that website owners install through the WordPress admin. It is not affected and continues to function normally.
• LSWS configuration files and the LSCache server-level configuration are unaffected. Sites continue to be cached and served normally.

What is affected and removed is specifically the cPanel-side management interface. After the update, cPanel users lose the icon in their cPanel that let them adjust cache settings, view statistics, and purge cache from inside cPanel. The cache itself keeps working at the server level.

What the vulnerability does

cPanel's advisory describes the issue as a privilege escalation allowing unauthorized root access, and confirms active exploitation in the wild. The technical details have not been fully published as of this writing, since LiteSpeed Technologies and cPanel coordinated to ship the mitigation (auto-uninstall) before publishing exploit specifics. What is clear from the language of the advisory is that an unauthenticated or low-privilege attacker could leverage the plugin's interaction with the cPanel system to obtain root-level execution on the underlying Linux host.

In practice, the threat model on a typical shared hosting box looks like this: any cPanel user account, including a customer with only a website and email, becomes a candidate for taking over the entire server. Any successful PHP exploit against any hosted website on the server could similarly chain into root access through the plugin's privileged operations. This is the same pattern that made CVE-2026-41940 so dangerous in April: the perimeter of attack expands from your own administrative interface to any user account on the system, and from there to the host.

The auto-uninstall mitigation is unusually aggressive because the vulnerability was being actively exploited and a coordinated patched-plugin release was not yet ready. Removing the affected code entirely is the simplest defense, even at the cost of breaking a feature that some customers were using. cPanel does not typically uninstall third-party software without operator action, so the choice here signals how seriously cPanel and LiteSpeed treated the threat.

What this means for cPanel users practically

If you are a cPanel customer (an end user with a website hosted on a cPanel server), here is what changes:

• The LiteSpeed icon disappears from your cPanel. If you previously used it to view cache statistics, purge cache, or change cache settings, that interface is gone.
• Your websites continue to be cached and served normally. LiteSpeed Web Server is still running. LiteSpeed Cache is still caching. Nothing about website performance changes.
• For WordPress sites, you can continue managing the cache through the LiteSpeed Cache plugin inside WordPress. That plugin is a separate product and is not affected.
• For non-WordPress sites that relied on the cPanel interface for cache management, you may need to ask support to clear cache manually until the LiteSpeed plugin ships a patched version.

For Gotekky managed customers, our support team can purge LiteSpeed Cache on request through server-level tools. The customer-facing impact of the auto-uninstall on managed servers is limited to losing the cPanel icon. We expect LiteSpeed Technologies to publish a patched version of the plugin in the coming days or weeks, at which point we will evaluate whether to redeploy it across the managed fleet based on the security review of the fix.

What Gotekky did and what managed customers need to know

The May 19 cPanel patch is deploying across our Toronto-based managed infrastructure today. The deployment process involves running cPanel's /scripts/upcp on every managed server, during which the automated uninstall of the LiteSpeed User-End plugin takes effect. We are verifying the cPanel build number on every node after the update completes and confirming that the plugin is no longer present.

We have audited managed servers for indicators of compromise associated with the exposure window. No compromise indicators have been observed on Gotekky managed infrastructure as of this writing. This audit covers the standard pattern of post-exploitation behavior in cPanel environments: unfamiliar cron entries, unexpected SSH authorized_keys additions, anomalous WHM account creation, suspicious shell history under cPanel user accounts, and modifications to wp-config.php and other configuration files across hosted sites.

For customers on Gotekky managed plans, no action is required. The patch is applied. The plugin is removed. If you previously used the LiteSpeed icon in cPanel to manage cache settings on your sites, our support team can handle those operations on request until LiteSpeed publishes a patched plugin and we review it for redeployment.

If you operate self-managed cPanel servers, do this today

The update path is the same as for any cPanel security release, but with the added consideration that this one removes a third-party plugin and you should verify both the update and the removal.

Apply the patch immediately:

/scripts/upcp --force

This runs cPanel's update process with the force flag, ignoring any scheduled delay. The automated fix that removes the LiteSpeed User-End plugin runs as part of this update.

Verify the cPanel build number matches one of the patched versions listed in cPanel's advisory. As of the May 19 release, the patched build numbers are in the 11.86, 11.110, 11.118, 11.126, 11.130, 11.132, 11.134, and 11.136 series, with CentOS 6 and CloudLinux 6 customers on the cl6110 branch (11.110.0.120). Check your specific build with:

/usr/local/cpanel/cpanel -V

Restart cpsrvd to ensure the updated daemon is running:

/scripts/restartsrv_cpsrvd

Verify the LiteSpeed User-End cPanel Plugin is no longer installed:

ls /usr/local/cpanel/3rdparty/lsws/ 2>/dev/null
ls /usr/local/cpanel/base/3rdparty/lsws/ 2>/dev/null
rpm -qa | grep -i litespeed-userend
ls /var/cpanel/lsws/ 2>/dev/null

The exact paths vary by cPanel version, but none of these locations should contain LiteSpeed User-End plugin files after the update. If you find files in these locations, the auto-uninstall did not complete and you should investigate.

Audit for compromise indicators

Because this vulnerability was actively exploited in the wild before the patch was available, conservative posture requires auditing for indicators of compromise on any cPanel server that ran the LiteSpeed User-End plugin and was internet-reachable in the period before the patch was applied. The audit checklist:

• WHM user accounts: review for unfamiliar root-level or reseller accounts created before the patch was applied.
• SSH authorized_keys: check /root/.ssh/authorized_keys and every cPanel home directory for keys you did not add.
• Cron jobs: check /etc/cron.d/, /var/spool/cron/, and every cPanel user's crontab for unfamiliar entries.
• Web shell artifacts: look for unfamiliar .php files in /home/*/public_html/ with recent modification times.
• Setuid binaries: find / -perm -4000 -type f 2>/dev/null and compare against a known-good baseline for the cPanel version.
• WHM access logs: review /usr/local/cpanel/logs/access_log and login_log for unfamiliar IP addresses, particularly those with successful root or admin sessions.
• System binaries: rpm -Va | grep -v "^.M" to detect modifications to packaged system files.

If any of these surface indicators of compromise, treat the server as compromised and follow a full incident response procedure: rotate all credentials including root, every WHM user, every cPanel user, all database passwords, all email account passwords, and all API tokens. Audit hosted websites for backdoors. Consider that the WHMCS billing platform may also be compromised if it ran on the same server.

Continuing to manage LiteSpeed Cache without the plugin

For sites that relied on the LiteSpeed User-End plugin for cache management, here are the alternatives until a patched plugin ships:

• WordPress sites: install or continue using the LiteSpeed Cache plugin (LSCWP) inside WordPress. It is a separate product, is not affected by this vulnerability, and provides full cache management through the WordPress admin.
• Non-WordPress sites: contact your hosting provider's support team to purge cache. Server-level tools can purge cache for specific sites or globally without the cPanel plugin.
• Self-managed servers: cache can be purged from the command line by touching .lscache_clear in the document root or using the LiteSpeed Web Admin Console at port 7080.

We expect LiteSpeed Technologies to publish a patched version of the plugin in the coming days. We will evaluate the security review of that release before deciding whether to redeploy the plugin across the Gotekky managed fleet. The conservative posture for hosting providers in general is to wait several weeks past the patched release before redeployment, to allow security researchers time to review the fix and identify any related issues.

The pattern: three cPanel emergencies in three weeks

This is the third cPanel emergency security release in just over three weeks. April 28 brought the CVE-2026-41940 authentication bypass that had been actively exploited as a zero-day since February. May 13 brought a planned-but-substantial patch covering five additional CVEs (CVE-2026-29205 through CVE-2026-29206 and CVE-2026-32991 through CVE-2026-32993). And now May 19 brings the LiteSpeed plugin emergency plus two additional cPanel security issues identified as SEC-73728 and SEC-73755.

The operational reality for any hosting business running on cPanel is that the patch cadence has accelerated significantly. Monthly maintenance windows are not sufficient. The hosting industry is moving toward continuous patch deployment with automated verification, and the security release model from cPanel is reflecting that shift. Gotekky has invested in automation for this exact pattern throughout 2026 and the response cadence on these three disclosures reflects that work.

For Quebec-based hosting providers under Law 25 and Canadian providers under PIPEDA more broadly, the regulatory expectation is that you can demonstrate proportionate technical safeguards. A cPanel server that was internet-reachable and ran the LiteSpeed User-End plugin without timely patching is not a defensible posture during a regulatory inquiry or breach response. Document your patch deployment, your compromise audit, and your customer communication so that the response work is auditable.

Gotekky publishes separate guides for each significant CVE in the hosting infrastructure stack and maintains them as new information arrives. The current security guide series covers the April 28 cPanel auth bypass, the May 13 WHMCS authorization bypass, four separate Linux kernel privilege escalation issues from late April through mid-May, this LiteSpeed plugin emergency, and a companion guide for the other May 19 cPanel issues (SEC-73728 and SEC-73755). Operators managing their own infrastructure should read the relevant guide in detail for each issue affecting their stack.