External risk intelligence

Plesk XML-RPC API SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-58046

Plesk is a web-based hosting control panel designed to be accessed over the internet for management purposes. As an administrative interface that is commonly exposed to the network to facilitate remote server management, the XML-RPC API represents an externally reachable surface in standard deployments.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Plesk XML-RPC API could allow authenticated users to access sensitive data from the Plesk database, potentially leading to a full compromise of the control panel. This issue affects web hosting environments that utilize Plesk for server management.

An API flaw allows database access.
Plesk is widely used for web hosting management.
Confirm Plesk relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker with existing low-level access to Plesk could exploit a weakness in the XML-RPC API to inject malicious SQL commands. This would allow them to query the Plesk database directly, potentially revealing sensitive information or enabling them to take full control of the hosting panel.

Attacker needs authenticated, low-privilege access.
Vulnerable XML-RPC API allows SQL injection.
Full compromise of the Plesk panel.

Live Threat

Current exploitation, exposure, and threat context

A remote, authenticated user with low privileges could exploit this vulnerability through the Plesk XML-RPC API to conduct SQL injection. This could allow them to read any data from the Plesk database, potentially leading to a complete compromise of the control panel.

Plesk database contents.
Authenticated API interaction.
Full panel compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Plesk's XML-RPC API necessitates action from teams managing hosting environments. Initial steps should focus on identifying all Plesk instances, assessing their exposure and business criticality, and pinpointing the accountable system owners before planning remediation.

Platform and infrastructure teams should own the issue.
Verify Plesk instance reachability and criticality.
Plan and coordinate remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Plesk and why is it used?

Plesk is a web-based hosting control panel used by administrators to manage servers, websites, and applications through a centralized interface. It simplifies tasks like configuring domains, managing databases, and handling email accounts. Because it acts as an all-in-one management hub, it is a core tool for hosting service providers and businesses running multiple websites on a single infrastructure.

What does CWE-89 mean for CVE-2026-58046?

CWE-89 refers to Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. In this vulnerability, the Plesk XML-RPC API fails to properly sanitize user-supplied input before processing it. This weakness allows an attacker to inject and execute their own SQL commands, letting them interact directly with the underlying database to read or modify data that should otherwise be protected.

Do I need administrative privileges to trigger this bug?

No, you do not need administrative access to initiate this, but you must have a low-privileged account on the system. The vulnerability is triggered by an already authenticated user interacting with the XML-RPC API. It is not triggered by unauthenticated visitors or anonymous users; the attacker must be able to log in to the interface first to send the malicious API requests.

How does Halo Surface Signal categorize this risk?

Halo Surface Signal identifies this as a high-priority issue because the XML-RPC API is an integral part of the Plesk interface. Since Plesk is designed to be accessible over the internet for remote server management, the API is often reachable externally in standard deployments. This visibility increases the likelihood that a malicious actor with even minimal credentials could reach and exploit the vulnerable component.

What is the first step to address CVE-2026-58046?

Begin by creating a complete inventory of all Plesk instances within your infrastructure to identify which systems are currently active. Once you have a list, determine which of these are reachable over the internet and assess their business criticality. Identify the specific teams or individuals responsible for these systems so you can coordinate a response plan, focusing on those most exposed to potential remote access.

References

support.plesk.com/hc/en-us/articles/42139500580119-Vulnerability-CVE-20…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.