Plesk CVE-2026-58046

Exploitation requires the attacker to (1) have valid credentials for a low-privileged Plesk account (CVSS PR:L - a customer/reseller-level login, not anonymous access) and (2) reach the Plesk XML-RPC API over the network. The specific vulnerable component is the XML-RPC API request handler, and the attack targets the backing Plesk database via blind SQL injection. Limiting factors that reduce real-world exposure: authentication is mandatory (so anonymous internet scanning cannot directly exploit it), and the XML-RPC/management interface must be network-reachable to the attacker - deployments that firewall the management port to trusted IPs meaningfully raise the bar. No non-default feature toggle is described; any Plesk build below 18.0.79.4 exposing the API to an authenticated low-privileged user is affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) indicates a network-reachable, low-complexity attack requiring only low-privilege authentication and no user interaction, with a scope change reflecting that access to the underlying database escalates into control of the whole panel. That scope change plus C:H/I:H/A:H is what pushes the score to critical. Countervailing signals: PR:L means the attacker must already hold a valid (even low-tier, e.g. reseller or customer) Plesk account, so this is not anonymous internet-wide exploitation; it is not in CISA KEV, and no EPSS score or public POC was provided, suggesting exploitation is not yet demonstrably widespread. No EPSS value was supplied, so probabilistic exploitation likelihood cannot be quantified from this data. On balance this is a genuine high priority in multi-tenant hosting environments (where untrusted low-privileged accounts are the norm) rather than a merely inflated high-CVSS issue, and it should be patched promptly.

An attacker who holds or purchases a low-tier Plesk account (e.g., a customer or reseller login on a shared-hosting server) authenticates to the XML-RPC API and submits a crafted request whose parameter injects blind SQL, then uses automated boolean/time-based extraction to read the Plesk database - dumping administrator credentials and secrets that enable full panel takeover. No user interaction is required and attack complexity is low; no public POC was identified at time of analysis.