EUVD-2026-51019
GHSA-cw8q-r6mc-84wq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable XML-RPC API with only low-privilege auth (PR:L) and no interaction; DB read escalating to full panel takeover justifies S:C and C/I/A:H.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
3DescriptionCVE.org
Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel.
AnalysisAI
SQL injection in the Plesk hosting control panel's XML-RPC API allows a remote, low-privileged authenticated user to inject crafted SQL and read arbitrary data from the Plesk database (CWE-89), which the vendor states leads to full compromise of the panel. All Plesk builds prior to 18.0.79.4 are affected, and WebPros has released a fixed version. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the very high 9.9 CVSS and scope-change to full panel takeover make this a high-priority patch.
Technical ContextAI
Plesk is a widely-used commercial web-hosting and server-management control panel (cpe:2.3:a:webpros:plesk). The vulnerability resides in its XML-RPC API, a programmatic management interface that accepts remote procedure calls. The root cause is CWE-89, improper neutralization of special elements used in an SQL command: user-controllable input passed through an XML-RPC method is concatenated into a database query without adequate parameterization or escaping, allowing an attacker to alter query logic. Because the advisory characterizes it as a 'blind' SQL injection, results are inferred indirectly (e.g., boolean/time-based responses) rather than returned in the response body, which typically means data is exfiltrated one condition at a time via automated tooling.
RemediationAI
Vendor-released patch: upgrade Plesk to 18.0.79.4 or later, which remediates the XML-RPC API SQL injection; follow the vendor guidance at https://support.plesk.com/hc/en-us/articles/42139500580119-Vulnerability-CVE-2026-58046-Blind-SQL-injection-in-Plesk-s-XML-RPC-API. Because Plesk supports automatic micro-updates, verify that auto-updates are enabled or apply the update manually via the Plesk Installer/CLI. As compensating controls until patching, restrict network reachability of the XML-RPC API endpoint by firewalling the Plesk management port (default 8443) to trusted administrative IP ranges, and audit/limit low-privileged panel accounts (resellers/customers) since exploitation requires a valid low-privilege login - trade-off: IP allow-listing can break legitimate remote API automation and reseller access, so validate integrations before enforcing. Do not rely on WAF rules alone against a blind injection, as boolean/time-based payloads are easily obfuscated.
Cross-tenant credential disclosure in WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to e
Privilege escalation in the Plesk web hosting control panel lets an authenticated low-privileged user abuse an improper
Privilege escalation to remote code execution in Plesk (18.0.52 through 18.0.79.6, and the 18.0.80.0 branch before 18.0.
Privilege escalation to root in Plesk for Linux (18.0.34 up to 18.0.79.9 / 18.0.80.5) lets a customer- or reseller-level
Plesk 17.0 through 18.0.31 version, is vulnerable to a Cross-Site Scripting. Rated critical severity (CVSS 9.0), this vu
Injection via improper neutralization of special elements in Plesk's DNS zone management functionality enables remote au
Cross-tenant insecure direct object reference in Plesk's database management interface allows any authenticated hosting
Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. Rated high severity (CVSS 7.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today