CVE-2026-58046: Blind SQL Injection in Plesk XML-RPC API
TL;DR - Critical authenticated blind SQL injection in Plesk XML-RPC API. - Affects Plesk Obsidian 18.x before fixed builds; low-privileged users can abuse it. - Patch urgently to 18.0.75.1 or 18.0.76.2, depending on branch.
Vulnerability at a Glance
| Field | Value |
|---|---|
| CVE ID | CVE-2026-58046 |
| CVSS Score | 9.9 Critical |
| Attack Vector | Remote, authenticated via XML-RPC API |
| Privileges Required | Low |
| Patch Available | Yes |
CVE-2026-58046 is a critical SQL injection issue in the Plesk XML-RPC API. Publicly available descriptions from NVD and the vendor indicate that a remote authenticated user with low privileges can trigger blind SQL injection and read arbitrary data from the Plesk database. Because Plesk is an administrative control plane, database exposure can translate into broad operational impact, including potential panel compromise.
The immediate operational takeaway is straightforward: this is not an unauthenticated internet wormable bug based on current public information, but it is still high priority. In multi-tenant hosting environments, reseller models, or any deployment with delegated panel accounts, “authenticated low privilege” still represents a realistic threat path.
What Is This Vulnerability?
CVE-2026-58046 is described as an improper neutralization issue in the Plesk XML-RPC API that results in blind SQL injection. In practical terms, some attacker-controlled input sent to the XML-RPC interface is not safely handled before being used in a database context. That allows an authenticated user to influence backend SQL queries in ways the application did not intend.
The “blind” part matters operationally. Blind SQL injection usually means the application does not simply dump query results back in the response body. Instead, attackers infer data through response timing, boolean conditions, error behavior, or subtle differences in server output. That often makes exploitation noisier and slower than direct SQL injection, but it remains dangerous because it can still expose sensitive database content and support privilege escalation inside the application.
For Plesk specifically, the impact is amplified by the product’s role. Plesk stores panel metadata, user and subscription information, service configuration, and potentially secrets or references that help an attacker pivot. Even if the initial primitive is only arbitrary data read from the database, control panel compromise can follow if database-resident credentials, tokens, or administrative state can be abused.
Technical Notes
Public sources currently do not expose the specific vulnerable parameter name, XML-RPC method, or code path. Defenders should avoid assuming the issue is limited to one visible endpoint pattern beyond the vendor’s statement that the XML-RPC API is affected.
A generic XML-RPC request structure in Plesk environments may resemble traffic to an XML endpoint with method calls embedded in the request body, for example:
POST /enterprise/control/agent.php HTTP/1.1
Host: plesk.example.com
Content-Type: text/xml
Cookie: PLESKSESSID=...
<?xml version="1.0"?>
<packet version="1.6.9.1">
<some-method>
<filter>
<id>123</id>
</filter>
</some-method>
</packet>
Because the vulnerable method is not publicly documented in the source material provided, defenders should treat unusual authenticated XML-RPC activity as suspicious until systems are patched.
Who Is Affected?
The affected product is Plesk Obsidian 18.x. Based on the vendor advisory context and supporting reporting, defenders should treat vulnerable versions as Plesk Obsidian 18.x prior to the fixed builds. Reported fixed versions are 18.0.75.1 and 18.0.76.2.
The exact full version matrix was not visible in the retrieved advisory excerpt, so the safest precise statement is: Plesk Obsidian 18.x below 18.0.75.1 and below 18.0.76.2 on the relevant maintained branch should be considered at risk until confirmed otherwise by the vendor. That branch-split is consistent with how vendors sometimes service multiple release lines, but administrators should verify their current build against the vendor advisory directly.
If you operate shared hosting, managed WordPress hosting, reseller plans, or internal infrastructure where many non-admin panel accounts exist, your exposure is higher. The vulnerability requires authentication, but “low-privileged authenticated” users are common in real Plesk deployments. In the absence of public evidence limiting exploitation to a narrow role type, assume any account able to reach the affected XML-RPC functionality could be relevant.
Technical Notes
To check the installed Plesk version on a server, administrators can use:
plesk version
Example output will show the installed Obsidian version and build:
Product version: Plesk Obsidian 18.0.74 Update #3
If the host reports a build earlier than 18.0.75.1 or 18.0.76.2, treat it as needing review and likely patching based on the available public guidance.
CVSS Score Breakdown
NVD lists this issue at CVSS 9.9 Critical. That score aligns with the nature of the bug: remote exploitation over a management interface, low privileges required, and a high-impact outcome involving arbitrary database access with potential full panel compromise.
The full CVSS vector string was not available in the research material provided here, so it would be incorrect to invent the individual metric values. Even without the vector string, defenders can infer the practical reasons for the high score: exploitation is remote, does not require administrative access, and can impact confidentiality severely. Because Plesk is a control panel, downstream integrity and availability consequences are also plausible if the attacker can move from data extraction to panel takeover.
When the full vector is unavailable, defenders should avoid over-optimizing around assumptions such as whether user interaction is required or whether scope changed. Operationally, the score already justifies urgent treatment. For prioritization purposes, this is a critical flaw in an internet-exposed administrative platform with realistic abuse paths in multi-user environments.
Technical Notes
If your vulnerability management process requires normalized enrichment, record the facts that are actually known:
CVE: CVE-2026-58046
Severity: Critical
CVSS Base Score: 9.9
Vector String: Not publicly confirmed in source material reviewed
Attack Context: Remote, authenticated, low privilege
Primary Impact: Blind SQL injection, arbitrary database reads, possible full panel compromise
That is preferable to filling the record with guessed metric values that may later conflict with vendor or NVD updates.
Exploitation Status
At the time of writing, there is no confirmed evidence of active exploitation in the wild from the primary sources reviewed. Specifically, the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, which means there is no CISA-confirmed known exploitation signal through that channel as of 2026-07-30.
There is also no verified public proof of concept confirmed from the source material provided. That does not mean one does not exist privately, and it does not reduce patch urgency much in practice. SQL injection in a hosting control panel is a class of vulnerability that experienced attackers can often reproduce quickly once an advisory names the affected component and impact.
Defenders should state this carefully in internal communications: PoC not confirmed publicly from available sources; active exploitation not confirmed; assume exploit development is plausible and patch on a priority basis. This framing avoids both underreaction and unsupported claims.
Technical Notes
Useful internal status language for tickets or change records:
Known exploitation in the wild: Not confirmed from reviewed primary sources
CISA KEV status: Not listed
Public PoC status: No verified public PoC confirmed from reviewed sources
Defender assumption: Exploitability likely within capability of skilled authenticated attackers
How to Detect It
Detection is challenging because the issue is described as blind SQL injection and the exact vulnerable XML-RPC method is not publicly identified in the materials reviewed. That means defenders should focus on anomalies around authenticated XML-RPC usage, especially from low-privileged accounts, rather than relying on a single signature.
Start by reviewing web server and Plesk-related logs for requests to XML-RPC or agent endpoints associated with the panel, particularly bursts of repeated authenticated requests that produce varying response times, repeated 200 responses with tiny payload changes, or sequences designed to enumerate data. Time-based blind SQL injection can create a recognizable pattern of repeated structurally similar requests spaced by predictable delays.
Also review account activity. If a low-privileged user suddenly generates administrative-looking API activity, high request volume against panel endpoints, or accesses the panel from unusual source IPs, treat it as suspicious. In shared hosting environments, correlate login logs with XML-RPC request bursts. Because public details are incomplete, behavior-based hunting is more reliable than exploit-string matching.
Technical Notes
Example web log patterns to hunt for:
POST\s+/(enterprise/control/agent\.php|.*xml.*rpc.*)\s+HTTP/1\.[01]
Look for repeated requests from the same authenticated session or IP with near-identical body sizes and abnormal timing. In Nginx access logs, a quick grep might be:
grep -E 'POST /(enterprise/control/agent\.php|.*xml.*rpc.*)' /var/log/nginx/access.log
For Apache:
grep -E 'POST /(enterprise/control/agent\.php|.*xml.*rpc.*)' /var/log/apache2/access.log
A simple Splunk query to identify repeated XML/API POSTs from a single source could be:
index=web sourcetype=access_combined
("POST /enterprise/control/agent.php" OR "xml-rpc" OR "XML-RPC")
| stats count values(uri_path) values(status) by src_ip, user, http_user_agent
| where count > 20
A rough Sigma-style concept for proxy or WAF telemetry:
title: Suspicious Repeated Authenticated Requests to Plesk XML-RPC Endpoint
logsource:
category: webserver
detection:
selection:
cs-method: POST
cs-uri-stem|contains:
- "/enterprise/control/agent.php"
- "xml-rpc"
condition: selection
level: medium
Because the vulnerable parameter is not public, combine these hunts with authentication logs, geo anomalies, and unexpected request timing spikes.
Mitigation and Patching
The primary mitigation is to upgrade Plesk Obsidian to a fixed release. Based on the source material provided, the reported fixed versions are 18.0.75.1 and 18.0.76.2. Administrators should upgrade to the appropriate maintained branch supported by their deployment and verify the result after patching.
If immediate patching is not possible, reduce exposure around the XML-RPC management surface. Limit panel access by IP where feasible, enforce MFA for all panel users, review and disable unnecessary low-privileged accounts, and monitor aggressively for authenticated API abuse. These are not substitutes for patching, because the vulnerability is reachable by authenticated low-privileged users, but they can reduce attacker opportunity in the short term.
Because the exact vulnerable method is not public in the source material, fully disabling only one narrow feature cannot be recommended with confidence. In the absence of precise vendor guidance beyond patching, defenders should assume the whole affected XML-RPC surface is risky and apply compensating controls at the network and identity layers until upgrades are complete.
Technical Notes
Check current version:
plesk version
Use the Plesk installer to update to the latest available build on your branch:
plesk installer update
Or launch the installer interactively if your operational workflow requires it:
plesk installer
After updating, verify the version again:
plesk version
If you need a temporary IP restriction at the reverse proxy layer, an Nginx pattern could look like:
location /enterprise/control/ {
allow 203.0.113.10;
allow 198.51.100.0/24;
deny all;
}
For Apache:
<Location "/enterprise/control/">
Require ip 203.0.113.10
Require ip 198.51.100.0/24
</Location>
If you cannot patch immediately, also force credential hygiene and access reduction:
- Reset passwords for panel users with unnecessary access
- Remove stale reseller or customer accounts
- Enforce MFA for all interactive panel access
- Restrict panel exposure to VPN or trusted admin IPs
References
The primary source for vulnerability identification and impact is the NVD entry for CVE-2026-58046. It states that improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, potentially leading to full panel compromise.
The vendor advisory is the authoritative source for remediation guidance and should be checked directly for any updated version tables, branch-specific instructions, or post-release clarifications. A secondary report cited the fixed versions as 18.0.75.1 and 18.0.76.2; because the directly retrieved vendor snippet did not expose the full matrix, administrators should validate the exact branch mapping in the vendor advisory before change execution.
For further reading on related topics, you may find these articles helpful: - What is Data Sovereignty? - What is Right to be Forgotten?
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.