RCE in Webpros Plesk
CVE-2026-48614
An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server.
Vulnerability class: RCE (Remote Code Execution)
CVSS v3 metric
CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Webpros Plesk — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-48614?
- CVE-2026-48614 is a critical-severity vulnerability in Webpros Plesk, classified under Code Injection. CVSS score: 9.9/10. Published 2026-07-06.
- How severe is CVE-2026-48614?
- Critical severity. CVSS v3 base score is 9.9 out of 10.