This vulnerability involves improper authorization in the Plesk XML API, enabling authenticated users to perform code injection (CWE-94). By injecting arbitrary configuration directives, an attacker can write files with root privileges and escalate their privileges fully on the underlying server. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges but no user interaction, with scope changed and high impact on confidentiality, integrity, and availability. No vendor-provided patch or remediation level is currently documented.

Successful exploitation results in arbitrary file write as root and full privilege escalation on the affected server, compromising confidentiality, integrity, and availability of the system. This can lead to complete system takeover by the attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Plesk XML API to trusted users only and monitor for suspicious activity. Avoid exposing the API to untrusted networks.