Plesk - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/plesk/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 30 Jul 2026 15:30:41 +0000Blind SQL Injection Vulnerability in Plesk XML-RPC APIhttps://feed.craftedsignal.io/briefs/2026-07-plesk-sql-injection/Thu, 30 Jul 2026 15:30:41 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-plesk-sql-injection/A blind SQL injection vulnerability, tracked as CVE-2026-58046, affects the Plesk XML-RPC API, potentially allowing unauthenticated attackers to execute arbitrary database queries.WebPros has issued a security advisory regarding a high-severity blind SQL injection vulnerability affecting the Plesk control panel, specifically within its XML-RPC API. The vulnerability, identified as CVE-2026-58046, impacts all Plesk versions prior to 18.0.79.4. This flaw permits an unauthenticated attacker to inject malicious SQL commands into the API, potentially leading to unauthorized data access, database modification, or sensitive information disclosure from the Plesk backend. Administrators are urged to update to version 18.0.79.4 or later to mitigate this risk. Because the vulnerability lies within the API interface, it is reachable over the network and does not require local system access or elevated user privileges, making it a priority for immediate patching in internet-facing deployments.

Impact

Successful exploitation of CVE-2026-58046 allows an unauthenticated remote attacker to execute arbitrary SQL queries against the Plesk database. This could lead to full unauthorized access to site configurations, user credentials, database contents, and other administrative data managed by Plesk. Such access could result in comprehensive data exfiltration or total compromise of hosted services. Organizations running legacy versions of Plesk are at risk if their API endpoints are accessible to untrusted networks.

Recommendation

  • Update all Plesk instances to version 18.0.79.4 or newer immediately to remediate CVE-2026-58046.
  • Review web server access logs for anomalous POST requests directed at XML-RPC API endpoints, specifically looking for common SQL injection characters (such as single quotes, semicolons, or sleep commands) in API payloads.
  • Restrict network access to the Plesk administrative interface and API endpoints to trusted IP addresses using firewall rules or ACLs to minimize the attack surface until patching is complete.
]]>highadvisoryweb-applicationsql-injectionvulnerability