CVE-2026-58046
A critical flaw in Plesk’s XML‑RPC API lets an authenticated low‑privileged user inject SQL. The attacker can read any data from the database and ultimately take full control of the panel. The issue is severe because it requires only a normal user account and no special privileges.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Plesk web hosting control panel, specifically its XML‑RPC API. No specific versions are listed, so any installation that uses the API could be vulnerable.
Real-world impact
An attacker who can log in with a low‑privileged account can run arbitrary SQL queries, read sensitive data, and eventually gain full control of the Plesk panel, potentially compromising all hosted sites.
Why this severity
The CVSS score of 9.9 reflects that the vulnerability is network reachable, requires low attack complexity, low privileges, no user interaction, and gives complete compromise of confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources