CVE-2026-87898: Plesk Site Import Turns a Customer DB Name Into Root - Patch to 1.12.2
The Situation
On 23 September 2026, WebPros published CVE-2026-87898 against Plesk's Site Import extension on Linux. The CVE record is short: OS command injection that lets a remote authenticated user execute code as root, CWE-78, CVSS 4.0 9.4 CRITICAL (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H).
Plesk's own advisory is more useful than the CVE blurb. Verbatim: a database name submitted during an import is not quoted as data before it is used in a command that runs with root privileges, which allows command injection. Impact, also verbatim: a Plesk customer without elevated privileges can run commands as the root user on the server, exposing other subscriptions, databases, credentials, and server config.
That is not "admin fat-fingered a shell." That is a paying tenant - or anyone who has taken over one of those logins - reaching host root through a feature operators leave on because customers migrate WordPress sites with it.
| Component | Affected | Fixed |
|---|---|---|
| Site Import on Plesk for Linux | 1.12.1 and earlier (CVE range starts at 1.6.6) | 1.12.2 |
| Plesk for Windows | Not affected | n/a |
The extension changelog for 1.12.2, dated the same day as the CVE, is one line: this update addresses a critical security issue, apply it as soon as possible. There is no interim workaround in the advisory. The update is the mitigation.
Why This Matters on Shared Plesk
Site Import is the "bring your site from the other host" button. It copies applications (WordPress, Joomla, Drupal, PrestaShop), folders, databases, and mail. Database names are customer-controlled input by design. Plesk then shells out as root to create or restore that database. If the name is concatenated into a command instead of passed as a quoted argument, the customer's string is the command line.
You do not need a reseller. You do not need SSH. You need a customer account that can start an import. On a multi-tenant box that is the entire threat model.
1.12.1 is not a safe pin. Site Import 1.12.1 (24 August 2026) was itself a critical-security release. Anyone who froze there after last month's patch is still in range for CVE-2026-87898.
Same-Day Sibling: CVE-2026-68492
Do not stop at Site Import. The same day, same finder (Ali Mustafa / rz1027), WebPros also published CVE-2026-68492: untrusted search path (CWE-426) that lets a remote authenticated user execute code as root via the Plesk RESTful API extension. CVSS 4.0 8.7 HIGH.
| Component | Affected | Fixed |
|---|---|---|
| Plesk for Linux | 18.0.34 through 18.0.80.7, and 18.0.81.0 | 18.0.80.8 or 18.0.81.1 |
| Plesk RESTful API extension | 2.4.2 through 2.4.6 | 2.4.7 |
| Plesk for Windows | Not affected | n/a |
| Plesk before 18.0.34, REST API before 2.4.2 | Not affected | n/a |
Plesk's advisory is explicit: the REST API extension is installed by default and hidden in the UI. A server can be affected even if nobody "installed" it. Both the Plesk build and the extension have to be in range at the same time. Confirm the extension anyway - do not trust an empty Extensions screen.
What to Do Now
1. Inventory Site Import
plesk bin extension --list | grep -i import
plesk bin extension --get-xml-info site-import
--list is the documented inventory. --get-xml-info is the version check Plesk used on the REST API advisory; you want fullVersion 1.12.2 or later. If Site Import is not installed, this CVE does not apply to that box - skip to the REST API check, do not assume the host is clean.
UI path from the advisory: Extensions → My Extensions, Site Import 1.12.2+.
2. Patch Site Import
Extensions auto-update daily, but a CRITICAL tenant-to-root is not a "wait for tonight's cron" event.
plesk bin extension --upgrade site-import
# if the catalog is stale, force it the way Plesk does for REST API:
plesk bin extension --install site-import
plesk bin extension --get-xml-info site-import # must show 1.12.2+
Or in the panel: Extensions → Update → Check Now, then update Site Import.
3. Patch the hidden REST API extension and the Plesk build
plesk version
plesk bin extension --get-xml-info rest-api
# force catalog if older than 2.4.7 (command from Plesk's CVE-2026-68492 advisory):
plesk bin extension --install rest-api
Then update Plesk itself to 18.0.80.8 or 18.0.81.1 (or later on that line) via Tools & Settings → Updates, or the procedure in Plesk's "How to update Plesk Obsidian to the latest build" article. Re-run both version checks after the update. A successful installer exit is not a substitute for reading the versions.
4. Fleet one-liner
for h in $(cat plesk-hosts.txt); do
ssh root@$h 'echo -n "$HOSTNAME "; plesk version | head -1; plesk bin extension --get-xml-info site-import 2>/dev/null | tr -d "\n"; echo; plesk bin extension --get-xml-info rest-api 2>/dev/null | tr -d "\n"; echo'
done
Anything showing Site Import ≤ 1.12.1, REST API ≤ 2.4.6, or Plesk 18.0.80.7 / 18.0.81.0 is still a customer-to-root box.
After You Patched
- Re-check every node. One missed extension is a whole-server compromise.
- Pin 1.12.2 / 2.4.7 / 18.0.80.8 (or 18.0.81.1) in whatever you use to image new Plesk nodes so rebuilds do not boot yesterday's catalog.
- If you do not need customer-driven imports on a given plan, uninstall or disable Site Import after patching - smaller attack surface, not a substitute for 1.12.2.
- Look back 30 days for tenant-to-root artifacts: new root cron, unexpected
authorized_keys, setuid binaries, outbound shells from Plesk PHP/Python. The advisory does not claim exploitation; that is not the same as "nobody tried it."
What We Don't Know Yet
Honesty section, because the primary sources leave these open:
- Not in CISA KEV as of this writing (catalog JSON pulled 2026-09-28). Absence from KEV is not a clean bill of health.
- CISA ADP SSVC on CVE-2026-87898: Exploitation none, Automatable no, Technical Impact total. That is CISA's enrichment of the CVE record, not a statement that nobody will exploit it next week.
- NVD status: Awaiting Analysis. No NVD-assigned CVSS 3.x; the 9.4 is the CNA (HackerOne / WebPros) CVSS 4.0 score.
- No public PoC cited in the advisory or CVE record. We are not reconstructing one. The quoting bug is vendor-stated; the exact argv, binary, and import wizard field are not published.
- Who can start an import is described as a customer without elevated privileges. The advisory does not enumerate which exact subscription permissions are required. Do not assume "I turned off SSH, so we are fine."
- Windows is out of scope per Plesk. Linux only.
If a KEV entry appears, treat any unpatched Linux Plesk box with Site Import ≤ 1.12.1 as compromised-until-proven-otherwise, not merely unpatched.
Sources
- Plesk - "Vulnerability CVE-2026-87898: Arbitrary code execution as root in Plesk's Site Import extension", support.plesk.com/hc/en-us/articles/43641151026583
- CVE Program - CVE-2026-87898 (published 2026-09-23; CWE-78; CVSS 4.0 9.4)
- NVD - CVE-2026-87898 (Awaiting Analysis as of 2026-09-28)
- Plesk - "Vulnerability CVE-2026-68492: Arbitrary code execution as root in Plesk via the Plesk RESTful API extension", support.plesk.com/hc/en-us/articles/43644058632983
- CVE Program - CVE-2026-68492 (CVSS 4.0 8.7 HIGH; CWE-426)
- Plesk - "How to manage Plesk extensions (install, disable, remove, update)", support.plesk.com/hc/en-us/articles/12377511962007
- Site Import 1.12.2 changelog (23 September 2026) - catalog listing
- CISA Known Exploited Vulnerabilities catalog JSON - no entry for CVE-2026-87898 or CVE-2026-68492 as of 2026-09-28