The vulnerability arises from incorrect authorization checks in the XML-RPC API of WebPros Plesk prior to version 18.0.78.4. Specifically, ownership verification is only enforced for certain lookup filters, and schema validation is bypassed for legacy protocol versions. This allows a low-privileged authenticated customer to retrieve domain information and FTP credentials belonging to other tenants. Since these credentials are stored in cleartext, an attacker can leverage them to execute code under another tenant's system user context, resulting in a critical cross-tenant security breach.

Successful exploitation leads to cross-tenant information disclosure of FTP credentials stored in cleartext, compromising confidentiality. It also enables code execution as another tenant's system user, impacting integrity and availability. The vulnerability affects tenant isolation and can lead to full compromise of other tenants' environments within the same Plesk installation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is released, restrict access to the XML-RPC API to trusted users only and monitor for suspicious activity involving domain lookups. Avoid using legacy protocol versions if possible.