Full Report
WebPros security advisory (AV26-761)
Analysis Summary
# Vulnerability: Blind SQL Injection in Plesk XML-RPC API
## CVE Details
- **CVE ID:** CVE-2026-58046
- **CVSS Score:** 9.8 (Critical) *(Note: Based on typical scoring for unauthenticated remote SQL injection in management panels)*
- **CWE:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command)
## Affected Systems
- **Products:** Plesk Control Panel
- **Versions:** All versions prior to 18.0.79.4
- **Configurations:** Systems with the XML-RPC API enabled and accessible.
## Vulnerability Description
A Blind SQL injection vulnerability exists within the XML-RPC API of the Plesk control panel. The flaw occurs due to insufficient sanitization of user-supplied input before it is used in SQL queries. Because it is a "blind" injection, an attacker cannot see the data directly but can infer information from the database by observing the server's response patterns or timing differences after sending specifically crafted XML-RPC requests.
## Exploitation
- **Status:** Not specified as exploited in the wild, but recognized as a significant risk.
- **Complexity:** Low to Medium (requires knowledge of SQL injection techniques).
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Potential to extract sensitive database information, including administrative credentials).
- **Integrity:** High (Potential to modify or delete database records).
- **Availability:** High (Potential to disrupt service or gain full administrative control over the hosting environment).
## Remediation
### Patches
- **Plesk 18.x:** Update to version **18.0.79.4** or later.
- WebPros typically releases these fixes via the Plesk "Micro-updates" system. Ensure the server is configured to receive automatic updates or manually trigger an update via the CLI: `plesk installer update`.
### Workarounds
- **IP Restricted Access:** Limit access to the XML-RPC API and the Plesk administrative interface (typically ports 8443/8880) to trusted IP addresses only using a firewall (iptables/firewalld).
- **Disable XML-RPC:** If the XML-RPC API is not required for integrations or mobile app usage, consider disabling or blocking access to the endpoint via web server configuration.
## Detection
- **Indicators of Compromise:** Unusual spikes in POST requests to `/enterprise/control/agent.php` or other XML-RPC endpoints.
- **Detection methods:** Review web server access logs for repeated requests to the XML-RPC API from unknown or suspicious IP addresses. Security teams can use vulnerability scanners (e.g., Nessus, OpenVAS) to check for the specific version string.
## References
- **Vendor Advisory:** hxxps[://]support[.]plesk[.]com/hc/en-us/articles/42139500580119-Vulnerability-CVE-2026-58046-Blind-SQL-injection-in-Plesk-s-XML-RPC-API
- **Cyber Centre Advisory:** hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/webpros-security-advisory-av26-761