CVE-2026-56843: Critical severity WebPros Plesk vulnerability
Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own, because ownership is enforced only for certain lookup filters and schema validation is bypassed for legacy protocol versions. This results in cross-tenant disclosure of other tenants' FTP credentials stored in cleartext, which can be leveraged to execute code as another tenant's system user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WebPros Pleskto a version that resolves this vulnerability.Fixed in 18.0.78.4 - Compensating control
Limit access to the Plesk XML-RPC API endpoint so only authorized/needed customers can reach it, reducing the risk of cross-tenant domain lookup and credential disclosure while remediation is applied.
- Operational
Rotate any FTP credentials that may have been disclosed via the Plesk XML-RPC API issue before further use.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56843?
The severity of CVE-2026-56843 is critical with a CVSS score of 9.9.
How do I fix CVE-2026-56843?
To fix CVE-2026-56843, update WebPros Plesk to version 18.0.78.4 or later.
What effect does CVE-2026-56843 have on WebPros Plesk users?
CVE-2026-56843 allows low-privileged authenticated users to access domains not owned by them due to incorrect authorization.
What versions of WebPros Plesk are affected by CVE-2026-56843?
WebPros Plesk versions prior to 18.0.78.4 are affected by CVE-2026-56843.
Is CVE-2026-56843 related to the XML-RPC API of WebPros Plesk?
Yes, CVE-2026-56843 involves incorrect authorization in the XML-RPC API of WebPros Plesk.