PT-2025-48951 · Webpros · Plesk

Published 2025-12-03 · Updated 2025-12-03 · CVE-2025-66431

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WebPros Plesk versions prior to 18.0.73.5 WebPros Plesk versions 18.0.74 through 18.0.74.2

Description A remote, authenticated user can execute arbitrary code as root through domain creation. An attacker requires “Create and manage sites” with “Domains management” and “Subdomains management” permissions to exploit this.

Recommendations Update WebPros Plesk to version 18.0.73.5 or later. Update WebPros Plesk to version 18.0.74.2 or later.

Fix

RCE

Weakness Enumeration

CWE-61

Related Identifiers

CVE-2025-66431

Affected Products

Plesk

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-66431 · Security Note
• https://support.plesk.com/hc/en-us/articles/36494997377687--CVE-2025-66431-Security-vulnerability-in-domain-creation-mechanism-allows-Plesk-users-to-execute-arbitrary-code-on-behalf-of-root · Note
• https://docs.plesk.com/release-notes/obsidian/change-log/#plesk-18074 · Note
• https://twitter.com/CVEnew/status/1996261690208633130 · Twitter Post
• https://docs.plesk.com/release-notes/obsidian/whats-new · Note
• https://t.me/CVEtracker/38769 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1996277787389214811 · Twitter Post