Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Ple…

CVE-2026-58046 describes a critical SQL injection vulnerability in the Plesk XML-RPC API caused by improper input neutralization. A remote authenticated user with low privileges can exploit this flaw to perform blind SQL injection attacks. The vulnerability allows reading arbitrary data from the Plesk database, potentially exposing sensitive configuration and credentials. Successful exploitation leads to full compromise of the Plesk control panel. The vulnerability requires only authenticated low-privileged access, lowering the barrier for exploitation. Plesk has published a dedicated advisory detailing the issue and remediation steps. The impact is rated high due to the potential for complete panel takeover.