The vulnerability is an improper symlink resolution that occurs before file access in the Plesk Site Import and Migrator extensions. This flaw allows the attacker to execute arbitrary code with root privileges on the underlying host. The primary impact is a full compromise of confidentiality, integrity, and availability, as the attacker can run any command as the system owner.

Affected products include WebPros Plesk Migrator and WebPros Plesk Site Import. Version information is not specified in the available data, so users should verify whether their deployed versions contain the flaw.

The CVSS score of 8.7 labels the vulnerability as high severity, and the attack vector requires a remote authenticated user. Because the EPSS score is unavailable and the issue is not listed in CISA KEV, the current exploitation likelihood is uncertain, but the potential impact remains significant. Attackers must first obtain valid credentials in Plesk; once authenticated, they can leverage the symlink flaw to gain root access on the server.