EUVD-2026-57273
GHSA-jcvh-gm3c-qh9q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description requires an authenticated customer/reseller account, so PR:L not PR:N; network-reachable panel with low complexity yields AV:N/AC:L and full C/I/A impact as DB admin, scope unchanged.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
3DescriptionCVE.org
Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to execute arbitrary code on behalf of the database server administrator.
AnalysisAI
Privilege escalation to remote code execution in Plesk (18.0.52 through 18.0.79.6, and the 18.0.80.0 branch before 18.0.80.2) lets a low-privileged panel user - a customer or reseller - abuse a flawed database cloning routine to run arbitrary code with the privileges of the database server administrator. Because Plesk multiplexes many tenants onto shared database infrastructure, this breaks tenant isolation and effectively hands a paying customer control of the shared DB admin context. No public exploit or CISA KEV listing has been identified; the vendor CVSS 4.0 score is 9.3 (Critical), though the vector's PR:N conflicts with the description's stated need for a low-privileged account.
Technical ContextAI
Plesk is a widely used web hosting control panel that provisions and manages databases (MySQL/MariaDB, PostgreSQL) on behalf of multiple isolated tenants on shared servers. The vulnerability lives in the database cloning process, which duplicates a database or its objects; CWE-266 (Incorrect Privilege Assignment) indicates the cloning operation runs - or lets tenant-supplied input run - under the elevated identity of the database server administrator rather than the requesting tenant's restricted role. When a low-privileged customer or reseller triggers a clone, attacker-influenced content (for example stored routines, definer clauses, or object definitions carried over during the copy) executes in the admin context, converting a privilege-assignment error into code execution as the DB administrator. The single affected CPE is cpe:2.3:a:webpros:plesk:*:*:*:*:*:*:*:* (WebPros/Plesk).
RemediationAI
Upgrade to a fixed Plesk build: 18.0.79.6 or later on the 18.0.79.x line, or 18.0.80.2 or later on the 18.0.80.x line (Vendor-released patch: 18.0.79.6 and 18.0.80.2). Apply the update through Plesk's own updater or your hosting provider's maintenance channel and confirm the running version afterward, since shared hosts may lag behind. Until patched, reduce exposure by restricting who can create customer/reseller accounts and by disabling or tightly limiting the database cloning capability for untrusted tenants where the panel permits it - accepting that this removes a convenience feature for legitimate users - and monitor database servers for unexpected admin-context activity or newly created privileged routines. Follow the vendor advisory at https://support.plesk.com/hc/en-us/articles/42521305418903-Vulnerability-CVE-2026-64639-Privilege-Escalation-via-Database-Cloning-in-Plesk for exact build guidance.
Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. Rated medi
A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to
The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via th
Cross-tenant credential disclosure in WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to e
SQL injection in the Plesk hosting control panel's XML-RPC API allows a remote, low-privileged authenticated user to inj
Authenticated remote attackers against WebPros Plesk (versions before 18.0.79.8, and 18.0.80 through 18.0.80.3) can inje
Arbitrary file write as root in Plesk's Backup Manager lets an authenticated customer escalate to full server compromise
Local privilege escalation to root affects the Backup Manager component of WebPros Plesk, where a time-of-check-to-time-
Privilege escalation in the Plesk web hosting control panel lets an authenticated low-privileged user abuse an improper
Privilege escalation to root in Plesk for Linux (18.0.34 up to 18.0.79.9 / 18.0.80.5) lets a customer- or reseller-level
Plesk 17.0 through 18.0.31 version, is vulnerable to a Cross-Site Scripting. Rated critical severity (CVSS 9.0), this vu
Cross-tenant insecure direct object reference in Plesk's database management interface allows any authenticated hosting
Same weakness CWE-266 – Incorrect Privilege Assignment
View allShare
External POC / Exploit Code
Leaving vuln.today