Plesk Migrator CVE-2026-65647

The attacker must hold a valid Plesk user account with at least low-level authenticated access (PR:L per CVSS vector) - entirely unauthenticated external attackers cannot exploit this flaw. The Plesk Migrator or Plesk Site Import extension must be installed and accessible to the attacker's account; if neither extension is present, the attack surface does not exist. The attack proceeds remotely over the network (AV:N) with no victim interaction required (UI:N) and low attack complexity (AC:L), meaning no race conditions or special timing is needed. Exploitation is bounded to Plesk installations with these specific extensions enabled; a minimal Plesk deployment without them is not affected. No additional non-default configuration beyond extension installation is identified as required.

The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H reflects a network-accessible, low-complexity attack requiring only a low-privilege authenticated account and no user interaction - signals pointing to meaningful real-world risk. The provided vector assigns no subsequent-system impact (SC:N/SI:N/SA:N), which appears conservative given the description explicitly states execution as root; root compromise on a shared hosting server typically affects all co-tenant data and services, suggesting subsequent-system impact should be evaluated as high. No EPSS score, CISA KEV listing, or POC availability was included in the available data, so exploitation probability cannot be independently quantified. However, symlink following to root-level file access is a well-understood attack class with a straightforward exploitation path once authenticated access is obtained. Risk is highest in shared hosting environments where multiple tenants hold valid Plesk credentials and where the Migrator or Site Import extensions are routinely used during customer onboarding.

An authenticated Plesk customer or reseller account holder plants a crafted symbolic link within a web directory or staging path that the Site Import or Migrator extension traverses during a migration job, pointing the symlink at a root-owned system file such as /etc/cron.d/backdoor or /root/.ssh/authorized_keys. When the extension executes its file operation with root privileges, it writes attacker-controlled content through the symlink to the target path, establishing persistent root-level access. No public proof-of-concept code is confirmed at time of analysis.