Critical SQL Injection in Plesk XML-RPC API Allows Full Panel Compromise

A critical SQL injection vulnerability in the Plesk XML-RPC API, tracked as CVE-2026-58046, allows authenticated low-privileged users to read arbitrary database data and potentially take full control of the hosting panel.

Key Points:

• CVE-2026-58046 is a critical SQL injection flaw in the Plesk XML-RPC API with a CVSS score of 9.9.
• The vulnerability allows remote authenticated low-privileged users to extract arbitrary data from the Plesk database.
• Successful exploitation can lead to full compromise of the hosting panel, including access to administrative credentials.
• No public proof of concept or patch details are currently available.

Plesk has disclosed a critical security flaw, CVE-2026-58046, affecting its XML-RPC API. The issue stems from improper neutralization of user input, which fails to be adequately sanitized or escaped before being incorporated into database queries. This oversight creates a classic SQL injection scenario that can be exploited by attackers with remote access and low-privileged authentication.

How are you currently monitoring for unpatched vulnerabilities in your Plesk installations?

Learn More: The Hacker Wire

Want to stay updated on the latest cyber threats?

👉 [Subscribe to r/PwnHub](https://www.reddit.com/r/pwnhub)