Description
OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WebPros | Plesk extension "Site Import" | 1.6.6 – ≤ 1.12.1 | — |
Critical · 9.4
CVE-2026-87898
EUVD-2026-85618GHSA-q589-mpmp-9796
OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.
Published Sep 23, 2026 · Updated Sep 23, 2026 · Assigned by hackerone