High · published December 3, 2025
⚡ An attacker with specific permissions can turn a simple domain creation into complete root access! 🎉 Think of it like a hotel guest who can check in and gain access to the entire building, including the staff-only areas, simply by booking an extra room. They shouldn't have the keys to the management office, but here they do! If exploited, this vulnerability allows remote authenticated users to execute arbitrary code as root, giving them the freedom to manipulate anything on the server. This could lead to data breaches, unauthorized access to sensitive information, or even total control over the system!
Think of it like a hotel guest who can check in and gain access to the entire building, including the staff-only areas, simply by booking an extra room. They shouldn't have the keys to the management office, but here they do! This vulnerability in WebPros Plesk allows authenticated users with the "Create and manage sites" permissions to execute arbitrary code as root when creating domains or subdomains. It's a serious oversight in permission checks that can have drastic consequences.
If exploited, this vulnerability allows remote authenticated users to execute arbitrary code as root, giving them the freedom to manipulate anything on the server. This could lead to data breaches, unauthorized access to sensitive information, or even total control over the system! To secure your system, update Plesk to version 18.0.74.2 or later immediately. Additionally, review user permissions to ensure that only trusted users have the ability to create and manage domains. Regularly audit user privileges to prevent any unauthorized access! You've got this! Follow these steps and you'll be a security hero in no time! 🛡️