An OS command injection flaw exists in the Plesk extension "Site Import" that permits a remote authenticated user to run arbitrary commands with root privileges. The vulnerability allows attackers to gain full control over the affected server, compromising confidentiality, integrity, and availability. This weakness corresponds to CWE-78.

The flaw impacts WebPros Plesk installations that include the "Site Import" extension. No specific version information is provided, so all installations of the extension when the vulnerability is present are at risk until a patch is applied.

The CVSS base score of 9.4 marks the issue as critical. With a lack of EPSS data, the historical exploitation probability cannot be quantified, but the vulnerability is listed as not part of the CISA KEV catalog. Remote attackers must be authenticated to exploit it, indicating that only users with legitimate access to the Site Import feature can launch the attack.