CVE-2026-68492: WebPros Plesk

High severity, CVSS 8.7. EPSS: 0.4% chance of exploitation in the next 30 days.

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.

Affected products

• WebPros Plesk: from 18.0.34, before 18.0.80.8 (fixed in 18.0.80.8); from 18.0.81, before 18.0.81.1 (fixed in 18.0.81.1)
• WebPros Plesk Extension Plesk Restful API: from 2.4.2, before 2.4.7 (fixed in 2.4.7)

Published 2026-09-23. Last modified 2026-09-24.