Improper privilege management in the XML‑RPC API of Plesk prior to version 18.0.80 allows an authenticated reseller to obtain an administrative session for the root user, giving the reseller full control over the system. This privilege escalation bypasses normal role restrictions, enabling the attacker to modify configurations, access sensitive data, and potentially compromise other clients on the server.

WebPros Plesk installations using the XML‑RPC API with versions earlier than 18.0.80 are affected.

The CVSS score of 9.9 indicates critical severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must already be authenticated as a reseller, so the exploitation path requires valid reseller credentials or compromise of reseller account access. Once the reseller obtains the elevated session, the attacker achieves full administrative authority.