Situation
A security vulnerability CVE-2026-58046 allowing a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database was discovered in Plesk's XML-RPC API.
Affected product version
| Product / Component | Affected versions | Patched version |
|---|---|---|
| Plesk | All versions below 18.0.79.4 | 18.0.79.4 |
Impact
An authenticated user with customer or reseller privileges can execute arbitrary SQL queries against the Plesk database. This may allow reading the entire database contents, including administrator credentials, potentially leading to full server compromise.
Call to action
- Log into Plesk.
- Go to Tools & Settings > Updates and Upgrades.
- Install the latest Plesk updates to update to version 18.0.79.4 or later.
- Verify the installed version under Tools & Settings > Server Components.
Mitigation
Apply this mitigation only if you cannot upgrade right now.
- Connect to the server via SSH.
-
Edit the
panel.inifile and add the following section to enforce strict API protocol version validation:CONFIG_TEXT: [api]
deprecationError = onThis setting blocks deprecated XML API protocol versions that allow bypassing input validation, preventing exploitation of this vulnerability.
- Upgrade to Plesk 18.0.79.4 or later as soon as possible.
- Connect to the server via SSH.
-
Edit the
panel.inifile and add the following section to restrict XML API access to trusted IP addresses only:Note: Replace
203.0.113.2and192.0.2.2with the actual IP addresses that should retain API access.CONFIG_TEXT: [api]
allowedIPs = 203.0.113.2,192.0.2.2For more details, see How to disable or restrict Plesk XML API.
Warning: Disabling or restricting the XML API will also affect REST API access.
- Upgrade to Plesk 18.0.79.4 or later as soon as possible.
Acknowledgements
We would like to thank Aziz Knani for responsibly disclosing this vulnerability.
Comments
We need Notification other “What's New” for out Plesk clients from Plesk central license portal.
Client should acknowledge that they have agreed not to apply and email is sent as validation .
is it feasible.
There are legacy servers that still can't be upgraded as they are stuck in older OS's for multiple reasons.
And these are licenses we are still paying for every month even if they are out of support …
I think for such a serious vulnerability, a patch , even if you just distribute 1-2 files for us to place by hand would be the right courtesy for a software panel like Plesk and for customers that have neen loyal to the platform for 20 years.
This is no small exploit to just not patch. I think you should reconsider this decision and help people with older versions out.
Tip: if you're using WHMCS, the 18.0.78 mitigation (strict API version checking - that Plesk is auto-applying to servers) will break your WHMCS single-sign-on to Plesk because the Plesk API version that WHMCS uses is not the latest.
The solution is to update to 18.0.79 Update #4. It seems Plesk devs implemented a solution that does not require strict API version checking.
where's the panel.ini? I just did a find -iname panel.ini in /opt and it's not found.
Xyonet Hosting You can use the Plesk Panel INI Editor extension in the GUI, or edit the file here:
/usr/local/psa/admin/conf/panel.iniDetails: https://docs.plesk.com/en-US/obsidian/administrator-guide/plesk-administration/panelini-configuration-file.78509/
Using the “IP Access Restriction Management” security feature in Plesk has, in the past, worked at blocking API access as well. Does that only apply when authenticating with the API as an admin and therefore it is insufficient to block a privilege escelation vulnerability like this?
Please sign in to leave a comment.