Blind SQL injection in Plesk XML-RPC API (CVE-2026-58046)

A blind SQL injection vulnerability exists in Plesk's XML-RPC API due to improper input neutralization. A remote authenticated user with customer or reseller privileges can execute arbitrary SQL queries against the Plesk database, potentially exposing all database contents including administrator credentials and leading to full server compromise. Affected versions: - All versions below 18.0.79.4 We recommend updating to: 18.0.79.4. CVSS 9.9 · our assessment: act_now Reference: https://support.plesk.com/hc/en-us/articles/42139500580119-Vulnerability-CVE-2026-58046-Blind-SQL-injection-in-Plesk-s-XML-RPC-API Details: https://vuln.today/cve/CVE-2026-58046