CVE-2026-64639: WebPros Plesk

Critical severity, CVSS 9.3. EPSS: 0.6% chance of exploitation in the next 30 days.

Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to execute arbitrary code on behalf of the database server administrator.

Affected products

• WebPros Plesk: from 18.0.52, before 18.0.79.6 (fixed in 18.0.79.6); from 18.0.80.0, before 18.0.80.2 (fixed in 18.0.80.2)

Published 2026-08-12. Last modified 2026-09-03.