CVE-2026-68492
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.
| CWE | CWE-426 |
| Vendor | webpros |
| Product | plesk |
| Published | Sep 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for webpros plesk
Be the first to know when new unknown vulnerabilities affecting webpros plesk are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
WebPros / Plesk
18.0.34 < 18.0.80.8 18.0.81 < 18.0.81.1
WebPros / Plesk extension "Plesk RESTful API"
2.4.2 < 2.4.7
References
Credits
Ali Mustafa (rz1027)