This vulnerability (CWE-426) in WebPros Plesk involves an untrusted search path issue that can be exploited by remote authenticated users to execute arbitrary code as root. The affected software versions are Plesk 18.0.34 through 18.0.80.7, 18.0.81 through 18.0.81.0, and the Plesk RESTful API extension 2.4.2 through 2.4.6. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote authenticated users to execute arbitrary code with root privileges on affected Plesk installations, potentially leading to full system compromise. The vulnerability affects core Plesk versions and the RESTful API extension, increasing the attack surface for privileged code execution.

A fix is available for this vulnerability as indicated by the specified unaffected versions starting from 18.0.80.8, 18.0.81.1, and 2.4.7 for the RESTful API extension. Users should upgrade to these or later versions to remediate the issue. No vendor advisory content was provided to contradict this, so applying the official patches is recommended.