Vulnerability CVE-2026-107246 in Plesk's Site Import extension

Pablo Alvarez

Updated November 09, 2026 09:39

kb: security kb: ai-created kb: ai-edited

Situation

A security vulnerability was discovered in Plesk's Site Import extension. This security vulnerability has been identified as CVE-2026-107246.

Affected product version

Product / Component	Affected versions	Patched versions
Site Import extension	1.13.1 and earlier	1.13.2

Impact

Arbitrary code execution as the root user is possible. A Plesk user without administrative privileges may be able to run commands on the server, which can compromise the whole server and all subscriptions hosted on it.

Call to action

Update the Site Import extension to version 1.13.2 or later. See How to manage Plesk extensions (install, disable, remove, update) for the update steps.

How to confirm the patched version is installed

Go to Extensions > My Extensions and check the version shown for the Site Import extension. It should be 1.13.2 or later.

Acknowledgement

We would like to thank Ady Elouej for responsibly disclosing this vulnerability and working with us to help protect our customers.