CVE-2026-48614

WebPros / Plesk PUBLISHED

Description (CNA)

An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server.

Affected (CNA)

Vendor / product	Versions
WebPros / Plesk	affected 0 before 18.0.78

CWE

CWE-94

References

https://support.plesk.com/hc/en-us/articles/41171817973143-Vulnerability-in-Plesk-XML-API

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.