What is the CVSS score of CVE-2026-56843?

CVE-2026-56843 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Plesk are affected by CVE-2026-56843?

WebPros Plesk hosting control panels before version 18.0.78.4 contain a critical multi-tenant isolation failure that permits compromised customer accounts to access other customers' FTP credentials…. A patch is available.

How to fix or mitigate CVE-2026-56843?

Within 24 hours: Identify all Plesk deployments and determine which operate in multi-tenant mode; review XML-RPC API access logs for domain enumeration activity from low-privilege accounts. Within 7 days: Disable or restrict XML-RPC API to trusted IP addresses only; rotate all FTP credentials across affected hosting accounts; implement network-level segmentation between customer environments. Within 30 days: Apply vendor patches immediately upon release (monitor Plesk security advisories for version 18.0.78.4 or later); conduct customer notification and post-incident credential audit.

Plesk CVE-2026-56843

EUVD-2026-42144 CRITICAL

Insufficiently Protected Credentials (CWE-522)

2026-07-08 hackerone

GHSA-m4rp-7vj2-ggpc

Authentication Bypass Plesk Webpros

9.9

CVSS 3.1 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Authenticated low-priv customer (PR:L) over the network with low complexity crosses the tenant trust boundary (S:C), leaking credentials (C:H) that enable code execution as another user (I:H/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 08, 2026 - 02:01 EUVD

Analysis Generated

Jul 08, 2026 - 01:22 vuln.today

DescriptionCVE.org

Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own, because ownership is enforced only for certain lookup filters and schema validation is bypassed for legacy protocol versions. This results in cross-tenant disclosure of other tenants' FTP credentials stored in cleartext, which can be leveraged to execute code as another tenant's system user.

AnalysisAI

Cross-tenant credential disclosure in WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to enumerate domains belonging to other tenants through the XML-RPC API, because ownership checks are applied only to certain lookup filters and schema validation is skipped for legacy protocol versions. Because affected FTP credentials are stored in cleartext, an attacker retrieves another tenant's FTP password and can pivot to executing code as that tenant's system user. No public exploit has been identified at time of analysis, but the flaw was reported via HackerOne and carries a CVSS 9.9 rating.

Technical ContextAI

Plesk is a widely used web-hosting control panel that manages multiple isolated customer tenants (domains, mailboxes, FTP accounts) on shared infrastructure and exposes an XML-RPC management API. The root cause is CWE-522 (Insufficiently Protected Credentials): FTP passwords are persisted in cleartext rather than hashed or encrypted, so any authorization gap that exposes the credential store directly yields usable secrets. The specific defect is a broken-authorization pattern where tenant-ownership enforcement is bound to particular XML-RPC lookup filters, and requests declaring a legacy protocol version bypass schema validation entirely - allowing a crafted domain-lookup call to sidestep the ownership constraint and read records the caller should not see. The affected component matches CPE cpe:2.3:a:webpros:plesk:*, i.e. all Plesk versions prior to the fixed 18.0.78.4 build.

RemediationAI

Vendor-released patch: update to Plesk 18.0.78.4 or later, which restores ownership enforcement across all XML-RPC lookup filters and closes the legacy-protocol schema-validation bypass; refer to https://support.plesk.com/hc/en-us/articles/41178305151255-Vulnerability-in-Plesk-XML-API-Cleartext-FTP-Password-Exposure for the authoritative guidance. Where immediate patching is not possible, restrict network access to the XML-RPC API endpoint (Plesk management port 8443 and the RPC interface) to trusted management IPs via firewall rules to shrink the attacker population, accepting that this blocks legitimate remote API automation from other sources. Because exposed FTP passwords are stored in cleartext, after patching rotate FTP credentials for all tenants and consider disabling or minimizing FTP in favor of SFTP/key-based access to devalue any credentials that may already have leaked; note that forcing credential rotation and protocol changes may disrupt customer automation and scheduled transfers. Tightening or reviewing customer-account provisioning (limiting who can obtain a low-privileged account) further reduces exposure until the update is applied.