internet-facing-service-vulnerabilitywidely-deployed-product-advisoryidentity-authentication-vulnerabilitycredential-access-method

Blind SQL Injection in Plesk XML-RPC API Exposes Admin Credentials

Vulnerability Disclosure · 4 sources · Updated 3mo ago · First seen Jul 30, 2026

WebPros disclosed CVE-2026-58046, a blind SQL injection flaw in the Plesk XML-RPC API that affects all Plesk versions earlier than 18.0.79.4. The vulnerability allows a remote authenticated user with low privileges, including customer- or reseller-level access, to query the Plesk database and read arbitrary contents. Plesk warned that exposed data can include administrator credentials, creating a path to full server compromise.

The issue is classified as CWE-89 and carries a CVSS v3.1 vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting high impact across confidentiality, integrity, and availability. Plesk has patched the flaw in 18.0.79.4 and urged administrators to update immediately; for systems that cannot be upgraded at once, the vendor recommended mitigations in panel.ini to enforce strict API protocol version validation or to restrict XML API access to trusted IP addresses only. The Canadian Centre for Cyber Security also issued advisory AV26-761, directing organizations to apply the vendor guidance.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Jul 30, 2026

Jul 30, 20263mo ago
Canadian Centre for Cyber Security issues advisory AV26-761
The Canadian Centre for Cyber Security published advisory AV26-761 about CVE-2026-58046, warning that WebPros Plesk is affected by a blind SQL injection flaw in the XML-RPC API. The advisory told users and administrators to review vendor guidance and apply updates as available.
WebPros security advisory (AV26-761) - Canadian Centre for Cyber Security
Reported Jul 28, 20263mo ago
Plesk discloses CVE-2026-58046 and releases fix in 18.0.79.4
Plesk disclosed CVE-2026-58046 as a blind SQL injection vulnerability affecting versions earlier than 18.0.79.4 and said it could allow low-privileged authenticated users to read arbitrary database contents, including administrator credentials. Plesk stated the issue was patched in version 18.0.79.4 and provided mitigations for systems that could not be upgraded immediately.
Vulnerability CVE-2026-58046: Blind SQL injection in Plesk's XML-RPC API - Plesk
Reported Jul 28, 20263mo ago
Aziz Knani responsibly discloses CVE-2026-58046 to Plesk
Plesk said CVE-2026-58046, a blind SQL injection flaw in the XML-RPC API, was responsibly disclosed by Aziz Knani. The source does not provide a date for the disclosure event.
Vulnerability CVE-2026-58046: Blind SQL injection in Plesk's XML-RPC API - Plesk

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Blind SQL Injection in Plesk XML-RPC API (CVE-2026-58046)

Affected products

2 linked

PleskPlesk

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

4 references tracked. Mallory keeps watching after this page renders.

Malware NewsNews · Jul 30, 2026

WebPros security advisory (AV26-761) - Malware News - Malware Analysis, News and IndicatorsOpen source ↗

Ca CcsNews · Jul 30, 2026

WebPros security advisory (AV26-761) - Canadian Centre for Cyber SecurityOpen source ↗

Cvefeed High SeverityAdvisories · Jul 30, 2026

CVE-2026-58046 - Plesk SQL Injection VulnerabilityOpen source ↗

Support PleskNews · Jul 28, 2026

Vulnerability CVE-2026-58046: Blind SQL injection in Plesk's XML-RPC API - PleskOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

internet-facing-service-vulnerabilitywidely-deployed-product-advisoryidentity-authentication-vulnerabilitycredential-access-method

Blind SQL Injection in Plesk XML-RPC API Exposes Admin Credentials

Vulnerability Disclosure · 4 sources · Updated 3mo ago · First seen Jul 30, 2026

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Jul 30, 2026

Jul 30, 20263mo ago
Canadian Centre for Cyber Security issues advisory AV26-761
The Canadian Centre for Cyber Security published advisory AV26-761 about CVE-2026-58046, warning that WebPros Plesk is affected by a blind SQL injection flaw in the XML-RPC API. The advisory told users and administrators to review vendor guidance and apply updates as available.
WebPros security advisory (AV26-761) - Canadian Centre for Cyber Security
Reported Jul 28, 20263mo ago
Plesk discloses CVE-2026-58046 and releases fix in 18.0.79.4
Plesk disclosed CVE-2026-58046 as a blind SQL injection vulnerability affecting versions earlier than 18.0.79.4 and said it could allow low-privileged authenticated users to read arbitrary database contents, including administrator credentials. Plesk stated the issue was patched in version 18.0.79.4 and provided mitigations for systems that could not be upgraded immediately.
Vulnerability CVE-2026-58046: Blind SQL injection in Plesk's XML-RPC API - Plesk
Reported Jul 28, 20263mo ago
Aziz Knani responsibly discloses CVE-2026-58046 to Plesk
Plesk said CVE-2026-58046, a blind SQL injection flaw in the XML-RPC API, was responsibly disclosed by Aziz Knani. The source does not provide a date for the disclosure event.
Vulnerability CVE-2026-58046: Blind SQL injection in Plesk's XML-RPC API - Plesk

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Blind SQL Injection in Plesk XML-RPC API (CVE-2026-58046)

Affected products

2 linked

PleskPlesk

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

4 references tracked. Mallory keeps watching after this page renders.

Malware NewsNews · Jul 30, 2026

WebPros security advisory (AV26-761) - Malware News - Malware Analysis, News and IndicatorsOpen source ↗

Ca CcsNews · Jul 30, 2026

WebPros security advisory (AV26-761) - Canadian Centre for Cyber SecurityOpen source ↗

Cvefeed High SeverityAdvisories · Jul 30, 2026

CVE-2026-58046 - Plesk SQL Injection VulnerabilityOpen source ↗

Support PleskNews · Jul 28, 2026

Vulnerability CVE-2026-58046: Blind SQL injection in Plesk's XML-RPC API - PleskOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Blind SQL Injection in Plesk XML-RPC API Exposes Admin Credentials

How this story unfolded

Canadian Centre for Cyber Security issues advisory AV26-761

Plesk discloses CVE-2026-58046 and releases fix in 18.0.79.4

Aziz Knani responsibly discloses CVE-2026-58046 to Plesk

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Blind SQL Injection in Plesk Obsidian Exposes Server Database Data

Privilege Escalation Flaw in Plesk XML-RPC API Exposes Root Admin Sessions

Critical Plesk APS flaw lets authenticated users execute server commands

Blind SQL Injection in Plesk XML-RPC API Exposes Admin Credentials

How this story unfolded

Canadian Centre for Cyber Security issues advisory AV26-761

Plesk discloses CVE-2026-58046 and releases fix in 18.0.79.4

Aziz Knani responsibly discloses CVE-2026-58046 to Plesk

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Blind SQL Injection in Plesk Obsidian Exposes Server Database Data

Privilege Escalation Flaw in Plesk XML-RPC API Exposes Root Admin Sessions

Critical Plesk APS flaw lets authenticated users execute server commands