The vulnerability arises from an untrusted search path in the Plesk web hosting control panel, specifically affecting versions 18.0.34 through 18.0.80.7 and 18.0.81 through 18.0.81.0. A remote authenticated user can trigger the execution of arbitrary code with root privileges by leveraging the Plesk RESTful API extension between versions 2.4.2 and 2.4.6. The flaw is a CWE-426: Untrusted Search Path, which permits the attacker to influence the order in which executable files are located, leading to elevated privileges. An attacker who can authenticate to the RESTful API can therefore run arbitrary commands as the root user, compromising confidentiality, integrity, and availability of the entire host.

Affected products are WebPros Plesk and the associated Plesk RESTful API extension. Vulnerable Plesk versions include 18.0.34 up to 18.0.80.7 and 18.0.81 up to 18.0.81.0. The RESTful API extension is vulnerable in versions 2.4.2 through 2.4.6. Users running these outdated combinations are at risk.

The CVSS score is 8.7, denoting high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating there is no publicly confirmed exploitation at the time of analysis. The attack vector is remote authenticated, meaning an attacker must first authenticate to the RESTful API using valid credentials. Once authenticated, the attacker can send crafted API requests that trigger the untrusted search path, resulting in arbitrary root code execution. Because the vulnerability requires authentication, the risk is bounded to hosts that permit widespread or compromised credentials; however, the impact is significant for systems exposed to the API.