This vulnerability (CVE-2026-64639) in WebPros Plesk arises from an incorrect privilege assignment during the database cloning process in versions 18.0.52 and 18.0.80.0. It enables low-privileged users (customers or resellers) to execute arbitrary code with the privileges of the database server administrator. The CVSS 4.0 vector indicates network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is classified under CWE-266 (Incorrect Privilege Assignment). No vendor advisory or patch information is currently available.

An attacker with low privileges on the affected Plesk versions can escalate their privileges to execute arbitrary code as the database server administrator. This can lead to full compromise of the database server, including unauthorized data access, modification, or destruction. The critical CVSS score reflects the high severity and potential for significant impact on confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict low-privileged user access to the affected Plesk versions and monitor for suspicious activity related to database cloning operations.