CVE Catalog
CVE-2026-58046
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk0.31%
23th percentile - higher than 23% of all known CVEs
Summary
Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel.
Risk Assessment
Risk of full compromise of the Plesk panel by an attacker with low privileges, potentially leading to breach of all data and services managed by the panel.
Recommendation
Update Plesk to a version that fixes this vulnerability and restrict access to the XML-RPC API to trusted users only.
Original NVD description (English source)
Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel.