This vulnerability arises from improper neutralization of input in the Plesk XML-RPC API, enabling a remote authenticated low-privileged user to execute SQL injection attacks. Successful exploitation can lead to unauthorized data access and full compromise of the Plesk panel, which manages web hosting environments. The CVSS 3.1 base score is 9.9, reflecting the critical impact on confidentiality, integrity, and availability.

An attacker with low-privileged authenticated access can exploit this SQL injection vulnerability to read arbitrary data from the Plesk database. This can lead to full compromise of the Plesk management panel, potentially allowing control over hosted services and sensitive data exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, restrict access to the Plesk XML-RPC API to trusted users only and monitor for suspicious activity involving authenticated users with low privileges.