EUVD-2026-42144
GHSA-m4rp-7vj2-ggpc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged Plesk customer account
-
DeliveryCall XML-RPC domain lookup with legacy protocol version
-
ExploitBypass ownership check and schema validation
-
ExecutionRead other tenants' cleartext FTP credentials
-
PersistAuthenticate over FTP as victim system user
-
ImpactExecute code as another tenant
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V6 - Authentication Credential protection in transit/storage
|
| Exploitation Conditions | Exploitation requires an authenticated low-privileged Plesk customer account on the target server (PR:L) and the ability to reach the XML-RPC API over the network (AV:N). The concrete trigger is a domain-lookup call that either uses a lookup filter for which ownership is not enforced or declares a legacy XML-RPC protocol version to bypass schema validation - either path defeats the tenant-ownership check. Successful credential-to-code-execution pivot additionally depends on the target tenant having FTP enabled with a reachable FTP service. Limiting factors: the attacker must already possess a valid customer account (not fully unauthenticated), the server must be running a version before 18.0.78.4, and the multi-tenant shared-hosting model must be in use - single-tenant Plesk installs with no other customers present little to disclose. |
| Impact | The signals point to a genuine high priority rather than an inflated CVSS. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H describes a network-reachable, low-complexity attack requiring only a legitimate low-privileged customer account (PR:L) with no user interaction, and a scope change (S:C) reflecting the cross-tenant boundary crossing - all consistent with the described cleartext-credential leak escalating to code execution as another tenant. EPSS and SSVC data were not provided, so exploitation probability and automatability cannot be quantified from the input; this is a gap, not a downgrade. It is NOT in CISA KEV and no POC is referenced, so there is no confirmation of active exploitation - the 9.9 score is driven by impact and low barrier, not by observed in-the-wild use. The main limiting factor is the PR:L prerequisite: an attacker must already hold a valid Plesk customer account on the target server, which is realistic on multi-tenant shared/reseller hosting where customer signups are common, but not applicable to single-tenant deployments. |
| Exploit ScenarioDerived | A low-privileged customer on a shared Plesk server authenticates to the XML-RPC API and issues a domain-lookup request using a legacy protocol version and a filter that skips the ownership check, returning domain records owned by other tenants along with their cleartext FTP credentials. The attacker logs in over FTP as a victim tenant's system user and drops or modifies files, achieving code execution in the victim's context. No public POC is referenced, but the low attack complexity and single required customer account make the chain straightforward once account access is obtained. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 08, 2026
Cross-tenant credential disclosure in WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to enumerate domains belonging to other tenants through the XML-RPC API, because ownership checks are applied only to certain lookup filters and schema validation is skipped for legacy protocol versions. Because affected FTP credentials are stored in cleartext, an attacker retrieves another tenant's FTP password and can pivot to executing code as that tenant's system user. No public exploit has been identified at time of analysis, but the flaw was reported via HackerOne and carries a CVSS 9.9 rating.
RemediationAI
Vendor-released patch: update to Plesk 18.0.78.4 or later, which restores ownership enforcement across all XML-RPC lookup filters and closes the legacy-protocol schema-validation bypass; refer to https://support.plesk.com/hc/en-us/articles/41178305151255-Vulnerability-in-Plesk-XML-API-Cleartext-FTP-Password-Exposure for the authoritative guidance. Where immediate patching is not possible, restrict network access to the XML-RPC API endpoint (Plesk management port 8443 and the RPC interface) to trusted management IPs via firewall rules to shrink the attacker population, accepting that this blocks legitimate remote API automation from other sources. Because exposed FTP passwords are stored in cleartext, after patching rotate FTP credentials for all tenants and consider disabling or minimizing FTP in favor of SFTP/key-based access to devalue any credentials that may already have leaked; note that forcing credential rotation and protocol changes may disrupt customer automation and scheduled transfers. Tightening or reviewing customer-account provisioning (limiting who can obtain a low-privileged account) further reduces exposure until the update is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Plesk is a widely used web-hosting control panel that manages multiple isolated customer tenants (domains, mailboxes, FTP accounts) on shared infrastructure and exposes an XML-RPC management API. The root cause is CWE-522 (Insufficiently Protected Credentials): FTP passwords are persisted in cleartext rather than hashed or encrypted, so any authorization gap that exposes the credential store directly yields usable secrets. The specific defect is a broken-authorization pattern where tenant-ownership enforcement is bound to particular XML-RPC lookup filters, and requests declaring a legacy protocol version bypass schema validation entirely - allowing a crafted domain-lookup call to sidestep the ownership constraint and read records the caller should not see. The affected component matches CPE cpe:2.3:a:webpros:plesk:*, i.e. all Plesk versions prior to the fixed 18.0.78.4 build.
Know when Plesk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Authenticated low-priv customer (PR:L) over the network with low complexity crosses the tenant trust boundary (S:C), leaking credentials (C:H) that enable code execution as another user (I:H/A:H).
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
1DescriptionCVE.org
Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own, because ownership is enforced only for certain lookup filters and schema validation is bypassed for legacy protocol versions. This results in cross-tenant disclosure of other tenants' FTP credentials stored in cleartext, which can be leveraged to execute code as another tenant's system user.
Executive ViewAI
WebPros Plesk hosting control panels before version 18.0.78.4 contain a critical multi-tenant isolation failure that permits compromised customer accounts to access other customers' FTP credentials and hosting environments. This vulnerability directly exposes your organization's clients to unauthorized system access, credential theft, and potential data compromise. No vendor patch is currently available, necessitating immediate compensating controls.
Disable or strictly IP-restrict XML-RPC API access; implement network segmentation to isolate customer environments from each other; enable comprehensive logging and alerting on XML-RPC domain enumeration queries; disable legacy protocol version support; require credential rotation for all FTP accounts; restrict low-privilege customer account administrative capabilities; monitor for cross-tenant access patterns in access logs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. Rated medi
A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to
The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via th
SQL injection in the Plesk hosting control panel's XML-RPC API allows a remote, low-privileged authenticated user to inj
Privilege escalation in the Plesk web hosting control panel lets an authenticated low-privileged user abuse an improper
Authenticated remote attackers against WebPros Plesk (versions before 18.0.79.8, and 18.0.80 through 18.0.80.3) can inje
Arbitrary file write as root in Plesk's Backup Manager lets an authenticated customer escalate to full server compromise
Local privilege escalation to root affects the Backup Manager component of WebPros Plesk, where a time-of-check-to-time-
OS command injection in Plesk allows any authenticated low-privilege panel account - customer, reseller, or subscription
Privilege escalation to remote code execution in Plesk (18.0.52 through 18.0.79.6, and the 18.0.80.0 branch before 18.0.
Privilege escalation to root in Plesk for Linux (18.0.34 up to 18.0.79.9 / 18.0.80.5) lets a customer- or reseller-level
Authenticated Plesk panel users can escalate to root on Plesk 18.0 (Obsidian) servers by exploiting incorrect access con
Exploit-DB