This vulnerability involves improper neutralization of inputs in the Plesk XML-RPC API, which allows a remote attacker with low-level authentication privileges to execute SQL injection attacks. Exploiting this vulnerability can result in unauthorized data disclosure and complete compromise of the Plesk management panel. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability.

An attacker with low-privileged authenticated access can exploit this SQL injection vulnerability to read arbitrary data from the Plesk database. This can lead to full compromise of the Plesk panel, including unauthorized access and control over the system managed by Plesk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Plesk XML-RPC API to trusted users only and monitor for suspicious activity related to SQL injection attempts.