by Kastro
Paper/Archive/CVE-2026-48614

CVE-2026-48614

WebPros Plesk — An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, r…

EPSS 0.6%CVSS 9.9
critical.is priorityof 100
39
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 47.8.478 × 209.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server.

Affected

ProductAffectedFixed inSource
Plesk< 18.0.7818.0.78CNA

Scores by source

hackerone (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsupport.plesk.com/hc/en-us/articles/41171817973143-Vulnerability-in-Plesk-XML-API