Loading vulnerability…
Blind SQL Injection in Plesk XML-RPC API
CVE-2026-58046 is a blind SQL injection vulnerability in the Plesk XML-RPC API affecting Plesk versions prior to 18.0.79.4. The flaw is caused by improper neutralization of attacker-controlled input in XML-RPC requests, allowing a remote authenticated user with low privileges, including customer- or reseller-level access, to execute arbitrary SQL queries against the Plesk database. Successful exploitation enables extraction of arbitrary database contents and can expose sensitive administrative data, creating a path to full compromise of the Plesk panel.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a remote authenticated low-privileged attacker to read arbitrary data from the Plesk database through blind SQL injection. Exposed data may include sensitive configuration and administrator credentials. Because compromise of administrative data can enable takeover of the management interface and broader control of the hosted environment, the vulnerability can lead to full compromise of the Plesk panel and potentially the underlying server environment.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, enforce strict API protocol version validation by enabling the vendor-recommended API deprecation check in the panel configuration, and restrict XML API access to trusted source IP addresses only. These measures reduce exposure by blocking deprecated XML API protocol versions associated with the input-validation bypass and by limiting who can reach the vulnerable interface. Restricting or disabling XML API access may also affect REST API functionality.
Patch, then assume compromise.
Upgrade Plesk to version 18.0.79.4 or later, which contains the vendor patch for CVE-2026-58046. Administrators should verify the installed Plesk version and apply the latest available product updates across affected systems.
No public exploits tracked yet. Mallory keeps watching.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.