CVE-2026-58046

Executive Summary

CVE-2026-58046 is a critical SQL injection flaw (CVSS 9.9) in the Plesk XML-RPC API, enabling authenticated low-privileged users to execute arbitrary SQL queries against the Plesk control panel database. Successful exploitation allows reading sensitive data (hashed credentials, domain configurations, API tokens) and, in many cases, writing new administrative accounts or modifying system configurations — leading to full panel compromise. All Plesk instances exposing the XML-RPC API (typically via ports 8443/8880) are affected; no patched version has been confirmed, and no public exploit exists, but the vulnerability class is trivially exploitable given access.

Technical Analysis

The vulnerability resides in the XML-RPC API endpoint of Plesk, which is exposed on the control-panel interface (typically TCP/8443 for HTTPS and TCP/8880 for HTTP, plus the default web server port 80/443 for the panel's login redirect). The NVD description pinpoints "improper neutralization" — i.e., user-supplied parameters are passed into SQL queries without proper parameterization or escaping.

Mechanism: The XML-RPC API accepts structured requests (e.g., <methodCall> wrapping <params>) for operations such as domain.get, customer.get, or server.info. Certain parameters intended as filters — e.g., filter-name, domain-name, or owner-login — are concatenated directly into a SQL WHERE clause. A low-privileged authenticated user (e.g., a reseller or domain owner) can replace a benign value with a quoted SQL payload, breaking out of the intended condition.

Attack surface specifics:

• Authentication boundary: The attacker must hold any valid panel account — even a restricted subscriber with no admin rights. Plesk’s default installation includes a admin user, but attackers may also create self-service trial accounts if enabled.
• Endpoint details: The API is accessed via POST /enterprise/control/agent.php or /login_up.php with XML-RPC content-type text/xml. Requests are authenticated via HTTP Basic auth or session cookies.
• SQL injection vector: The injection point is likely a LIKE or = comparison in queries such as SELECT * FROM domains WHERE name = '$input'. By sending ' OR 1=1 -- -, an attacker dumps all domains; by sending ' UNION SELECT ... they can exfiltrate hashes from sys_accounts or secret_keys tables.

Why CVSS 9.9: The vector is network-exploitable (AV:N) with low complexity (AC:L) and requires only low-privilege credentials (PR:L). No user interaction (UI:N) and a scope change (S:C) because the DB compromise impacts resources beyond the vulnerable component. CIA impact is high across the board (C:H/I:H/A:H) — full read/write to the Plesk DB and, via subsequent file/OS-level actions, total server takeover.

Affected component internals: Plesk uses a MySQL/MariaDB backend (psa database). The XML-RPC layer (api/) maps method calls to PHP functions that construct queries via the db.php helper. The lack of prepared statements in these handlers is the root cause.

Plesk’s XML-RPC API is enabled by default in most installations, making the exposure near-universal for public-facing panels. However, the API can be disabled via admin → Tools & Settings → Application Interfaces — many admins leave it enabled for automation.

Exploitation Scenarios

The following attack chain describes a realistic exploitation path, assuming no public PoC but a thorough understanding of the vulnerability class.

Step 1 — Reconnaissance and target identification: The attacker scans the internet for hosts with Plesk panel indicators. Using Shodan dorks (http.title:"Plesk", product:"Plesk" port:8443), they build a target list. They verify accessibility of the XML-RPC endpoint by sending a benign <methodCall> like <methodName>server.get</methodName> and checking for a valid XML response. They then probe for a low-privilege account — either by finding exposed test/demo credentials in public configs, or by registering a self-service trial account if the panel allows it.

Step 2 — Authentication and injection trigger: The attacker authenticates to the XML-RPC API using their low-privilege credentials (e.g., subscriber:password). They craft a request to a method that accepts a filter parameter, for instance:

<methodCall>
  <methodName>domain.get</methodName>
  <params>
    <param><value><string>nonexistent' OR '1'='1</string></value></param>
  </params>
</methodCall>

The backend constructs SQL: SELECT id, name FROM domains WHERE name = 'nonexistent' OR '1'='1' — returning the entire domains table, leaking domain ownership and internal IDs.

Step 3 — Payload weaponization: To escalate, the attacker uses a stacked-query or UNION-based payload to extract credential hashes. They send:

<param><value><string>' UNION SELECT login, passwd FROM sys_accounts -- -</string></value></param>

The response includes rows of usernames and SHA-512-crypt hashes. They crack these offline (using hashcat) or attempt direct reuse of existing admin session tokens from secret_keys.

Step 4 — Post-exploitation — full panel compromise: With a valid admin hash (or by using the injection to write a new admin row via an INSERT if the DB user has sufficient privileges):

1. They log into the Plesk admin panel.
2. They create a new administrative account for persistence.
3. They use the panel’s built-in “File Manager” or “Tools & Settings → Server” features to write a PHP web shell into the httpdocs directory of a hosted domain.
4. They execute OS commands via the shell, achieving remote code execution on the underlying server — potentially pivoting to other hosted websites, database servers, and the host OS.

Parenthetical note: No public PoC has been released, and the CISA KEV list does not include this CVE, but the exploitation path is deterministic given the SQLi class and standard Plesk internal table structures.

Impact Assessment

Business impact: A successful exploit yields complete control of the Plesk panel and the underlying server. For hosting providers, this means:

• Data breach: Exposure of all customer databases, email credentials, and SSL private keys.
• Ransomware/defacement: Attackers can take down all hosted sites or inject malicious content.
• Lateral movement: Compromised server can be used to attack internal infrastructure or other customer environments.

Affected systems: Any Plesk installation (Obsidian, Onyx, or older) with the XML-RPC API enabled. Default installations meet this criterion. The CVSS scope change (S:C) reflects that the DB compromise extends beyond the API component to all panel-managed resources.

Blast radius: Full DB read/write → admin panel access → OS-level RCE. The capability to write arbitrary files via the panel interface amplifies the impact from data theft to full server takeover. Even a least-privilege attacker can pivot to system-level compromise within minutes.

CVSS subscore reference:

• Attack vector: Network (AV:N) — remotely exploitable.
• Privileges required: Low (PR:L) — any valid account suffices.
• Confidentiality/Integrity/Availability: High/High/High — full DB control.

Detection Guidance

Sigma Rule

title: Plesk XML-RPC SQL Injection Attempt
id: 0b8e2f3a-4d6c-4f8a-9b2e-1a4f6c8e0d2b
status: experimental
description: Detects SQL injection patterns in Plesk XML-RPC API requests
logsource:
  category: webserver
  product: plesk
  service: apache
detection:
  selection_api:
    cs-method: POST
    cs-uri-query|contains:
      - '/enterprise/control/agent.php'
      - '/login_up.php'
  selection_payload:
    cs-uri-query|contains|all:
      - 'UNION'
      - 'SELECT'
    cs-uri-query|contains:
      - "OR '1'='1"
      - '-- -'
      - 'OR 1=1'
  condition: selection_api and selection_payload
  timeframe: 5m
level: high
falsepositives:
  - Legitimate API automation using complex filters (rare)

YARA Rule

rule Plesk_XMLRPC_SQLi_Payload {
    meta:
        author = "ValtersIT Threat Intel"
        description = "Detect SQLi payloads in Plesk XML-RPC requests"
        cve = "CVE-2026-58046"
        severity = "critical"
    strings:
        $api_agent = "/enterprise/control/agent.php" ascii wide
        $api_login = "/login_up.php" ascii wide
        $union_sel = "UNION SELECT" ascii wide nocase
        $or_true1 = "OR '1'='1" ascii wide nocase
        $or_true2 = "OR 1=1" ascii wide nocase
        $comment    = "-- -" ascii wide
        $sleep      = "sleep(" ascii wide nocase
        $hex_db     = "information_schema" ascii wide nocase
    condition:
        (uint16(0) == 0x4D3C or uint16(0) == 0x3C3F) and // "<M" or "<?"
        any of ($api_agent, $api_login) and
        (any of ($union_sel, $or_true1, $or_true2, $sleep, $hex_db) or $comment)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-58046 Plesk XML-RPC SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/enterprise/control/agent.php"; http_uri; nocase; content:"UNION"; http_client_body; nocase; content:"SELECT"; http_client_body; nocase; content:"OR"; http_client_body; nocase; pcre:"/(' OR '1'='1|OR 1=1|-- -)\s*(?:<|\/|\x00)/iU"; classtype:attempted-admin; reference:cve,2026-58046,url,plesk.com; sid:10045804; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where event.type == "connection" and destination.port in (8443, 8880)]
  [http where request.method == "POST" and request.uri contains "/enterprise/control/" and
    request.body.text contains "UNION" and request.body.text contains "SELECT"]
  [http where request.body.text contains "OR '1'='1" or request.body.text contains "OR 1=1"]

Splunk SPL Query

index=web sourcetype=access_combined
| eval body_decode = urldecode(_raw)
| where method="POST" AND (uri="/enterprise/control/agent.php" OR uri="/login_up.php")
| rename src_ip as client_ip
| search body_decode IN ("UNION SELECT", "OR '1'='1", "-- -", "OR 1=1")
| table _time, client_ip, uri, body_decode
| stats count by client_ip, uri
| sort - count

Wazuh OSSEC Rule

<group name="plesk_sqli,">
  <rule id="100580" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">http</field>
    <field name="http.method">POST</field>
    <field name="http.uri">/enterprise/control/agent.php|/login_up.php</field>
    <match>UNION SELECT|OR '1'='1|OR 1=1|-- -</match>
    <description>Plesk XML-RPC SQL injection attempt (CVE-2026-58046)</description>
    <group>cve-2026-58046,attack,sqli,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. The CVE data indicates no vendor fix, no affected version list, and no workarounds from tracked sources. The following steps are defensive measures and should be re-evaluated once Plesk releases an official advisory.

1) Immediate mitigations (assume zero-day):

• Disable the XML-RPC API if not strictly required: Plesk Admin → Tools & Settings → Application Interfaces → disable “XML-RPC API”. This is the single most effective control.
• Restrict network exposure: Use a firewall to limit access to ports 8443/8880/80/443 to trusted IP ranges only (e.g., VPN or admin network). Do not expose the panel directly to the internet — use a reverse proxy with IP allow-listing.
• Enforce least-privilege accounts: Audit all panel user accounts and disable self-service signup if enabled. Any low-privilege account is a valid entry point.
• Enable web application firewall (WAF) rules that block SQLi patterns in POST bodies targeting the XML-RPC paths. Deploy a WAF (ModSecurity, Cloudflare WAF, or F5 ASM) with OWASP CRS.

2) Patch/upgrade steps:

• Monitor the official Plesk advisory page (https://support.plesk.com) and the CVE feed for the release of a security update. Apply the hotfix or the next minor version (e.g., 18.0.x → 18.0.y) immediately upon release.
• If Plesk publishes a configuration flag or an updated api/ module, upgrade the package via plesk installer or package manager (for Linux: apt upgrade plesk or dnf update psa; for Windows: use the Plesk installer).

3) Long-term hardening:

• Run the panel and database on separate VLANs; restrict DB connections to localhost only.
• Enable Plesk’s two-factor authentication for admin and reseller accounts.
• Implement database-level query logging (MySQL general log) on a dedicated log server to catch future attempts.
• Regularly test backup/restore procedures; in case of compromise, assume all hosted data is breached and rotate every credential (panel, FTP, email, DB).
• Subscribe to Plesk security advisories and the CISA KEV feed to stay current on exploitation-in-the-wild status.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-58046 — Official CVE description and CVSS vector.
2. Plesk Security Advisories: https://support.plesk.com/hc/en-us/sections/360010784734-Security — Vendor advisory hub (monitor for upcoming patch announcements).
3. MITRE ATT&CK — T1190: https://attack.mitre.org/techniques/T1190/ — Exploitation of Public-Facing Application technique mapping.
4. CWE-89 (SQL Injection): https://cwe.mitre.org/data/definitions/89.html — Weakness classification reference.
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Confirms this CVE is NOT listed as of this report date; revisit periodically for updates.

Threat actor campaign evidence: No known exploitation-in-the-wild or public PoC has been observed at the time of writing. The EPSS score of 0.00343 (27th percentile) indicates a low immediate exploitation probability, but the critical CVSS rating and ease of exploitation warrant proactive mitigation.