An improper neutralization of user input in the Plesk XML‑RPC API enables a remote authenticated low‑privileged user to inject arbitrary SQL statements. The injection permits the extraction of any data stored in the Plesk database, effectively granting the attacker full control over the panel. This flaw is characterized by CWE‑89 and allows attackers to read sensitive configuration information, user credentials, and other critical data with little effort once they have authenticated.

The vulnerability affects the Plesk control panel supplied by WebPros. No specific version numbers are listed in the advisory, so all installations that have not applied the latest patch should be considered at risk.

The CVSS score of 9.9 indicates critical severity, while the EPSS score of less than 1% suggests that exploitation is considered rare at the moment. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote authenticated user who can send XML‑RPC requests to the server; once exploitation occurs, the attacker can read arbitrary data and ultimately compromise the panel.