CVE-2026-56843

Severity: critical (CVSS 9.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-08 · updated 2026-10-25
Weakness: CWE-522

Description

Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own, because ownership is enforced only for certain lookup filters and schema validation is bypassed for legacy protocol versions. This results in cross-tenant disclosure of other tenants' FTP credentials stored in cleartext, which can be leveraged to execute code as another tenant's system user.

Affected products

WebPros Plesk: from 10.4 before 18.0.78.4 — fixed in 18.0.78.4

How to fix

Upgrade to a fixed version: WebPros Plesk 18.0.78.4. Check the vendor advisory for mitigations.

References

https://support.plesk.com/hc/en-us/articles/41178305151255-Vulnerability-in-Plesk-XML-API-Cleartext-FTP-Password-Exposure

Get alerted when CVE-2026-56843 or the next vulnerability affects your stack