A critical security update has been released for Plesk
Plesk has disclosed and patched a high-severity security vulnerability tracked as CVE-2026-58046. The issue affects the XML-RPC API and impacts all Plesk versions prior to 18.0.79.4.
The vulnerability allows an authenticated user with low privileges to exploit a SQL injection flaw within the XML-RPC API. Successful exploitation may expose sensitive information stored in the Plesk database, including administrator credentials, and in certain scenarios could ultimately lead to full server compromise.
Administrators running affected versions should update their servers as soon as possible.
Affected Versions
| Item | Details |
|---|---|
| CVE | CVE-2026-58046 |
| Severity | High |
| Affected Component | Plesk XML-RPC API |
| Affected Versions | All versions below 18.0.79.4 |
| Fixed Version | Plesk Obsidian 18.0.79.4 and later |
| Attack Requirement | Authenticated low-privileged account |
How the vulnerability works
According to the official advisory, the vulnerability originates from improper neutralization of input within the XML-RPC API.
Under specific conditions, an authenticated user can submit specially crafted requests that manipulate SQL queries executed by the Plesk backend.
Unlike vulnerabilities that only expose limited information, SQL injection flaws can provide direct access to backend databases. Depending on the server configuration and stored data, attackers may retrieve administrative credentials, customer information, service configuration details, or other sensitive records.
WordPress Web Hosting
Starting From $3.99/Monthly
Although authentication is required, hosting providers and organizations operating shared environments should consider this issue a high priority because multiple users commonly have access to the control panel.
Potential Impact
Servers that remain unpatched may be exposed to several risks, including:
- Reading arbitrary records from the Plesk database
- Disclosure of administrator credentials
- Exposure of customer information
- Privilege escalation
- Complete server compromise in certain scenarios
The actual impact depends on server configuration, user permissions, installed extensions, and the sensitivity of stored information.
Determine Your Installed Version
Before applying any changes, verify the installed version of Plesk.
From the Plesk interface:
Tools & Settings → Server Components
Cheap VPS Server
Starting From $2.99/Monthly
Or using SSH:
plesk versionIf the reported version is earlier than 18.0.79.4, the server should be updated immediately.Updating Plesk
Plesk recommends installing the latest available updates without delay.
To update through the web interface:
- Sign in to Plesk.
- Open Tools & Settings.
- Select Updates and Upgrades.
- Install all available updates.
- Confirm that the installed version is 18.0.79.4 or newer.
Before performing any production update, ensure that a recent system backup is available.
Temporary Mitigation
If an immediate upgrade is not possible, Plesk recommends enabling strict XML API protocol validation.
Windows VPS Hosting
Remote Access & Full Admin
Edit the panel.ini file and add:
[api]
deprecationError = onThis setting blocks deprecated XML API protocol versions that may bypass input validation, reducing the likelihood of successful exploitation.
It should only be considered a temporary mitigation until the official update can be installed.
Additional Protection for Plesk Onyx
Administrators still running Plesk Onyx 17.x or older releases should restrict XML API access to trusted IP addresses.
Example configuration:
[api]
allowedIPs = 203.0.113.2,192.0.2.2Replace the example IP addresses with the systems that legitimately require XML API access.
Be aware that restricting or disabling XML API access may also affect applications using the Plesk REST API.
Security Recommendations
Keeping Plesk up to date is the most effective protection against this vulnerability, but additional security measures should also be part of every server administration strategy.
Limit Administrative Access
Restrict administrator access to trusted IP addresses whenever possible and avoid exposing management interfaces to the public Internet.
Enable Multi-Factor Authentication
Two-factor authentication significantly reduces the risk of account compromise, even if user credentials are leaked.
Review User Accounts
Because exploitation requires an authenticated account, administrators should periodically review existing users, remove inactive accounts, and ensure that users have only the permissions they require.
Monitor Server Logs
Review authentication logs, database activity, and API access logs for unusual behavior, especially if the server has remained unpatched for an extended period.
Apply Security Updates Regularly
Security patches should be installed as part of routine maintenance rather than postponed until vulnerabilities become publicly exploited.
Frequently Asked Questions
Is CVE-2026-58046 remotely exploitable?
Yes, but the attacker must first authenticate with a valid low-privileged Plesk account.
Which Plesk versions are affected?
Every version earlier than 18.0.79.4.
Does the mitigation completely fix the vulnerability?
No. The mitigation reduces the attack surface but does not replace the official security update.
How do I know whether my server is protected?
Verify that your server is running Plesk 18.0.79.4 or a newer version.
Should managed hosting customers take action?
If your provider manages operating system and control panel updates, contact them to confirm that the security update has already been applied.
