PT-2026-56285 · Webpros · Plesk

Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-56843

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WebPros Plesk versions prior to 18.0.78.4

Description Incorrect authorization in the XML-RPC API allows a low-privileged authenticated customer to look up domains they do not own. This occurs because ownership is enforced only for specific lookup filters and schema validation is bypassed for legacy protocol versions. This flaw leads to cross-tenant disclosure of other tenants' FTP credentials stored in cleartext, which can be used to execute code as another tenant's system user.

Recommendations Update WebPros Plesk to version 18.0.78.4 or later.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2026-56843

Affected Products

Plesk

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-56843 · Security Note
• https://twitter.com/CVEnew/status/2074728401647161842 · Twitter Post
• https://support.plesk.com/hc/en-us/articles/41178305151255-Vulnerability-in-Plesk-XML-API-Cleartext-FTP-Password-Exposure · Note
• https://twitter.com/infoflowcloud/status/2074730502846628159 · Twitter Post