CVE-2025-66431

WebPros Plesk before 18.0.73.5 and 18.0.74 before 18.0.74.2 on Linux allows remote authenticated users to execute arbitrary code as root via domain creation. The attacker needs "Create and manage sites" with "Domains management" and "Subdomains management."

CVSS 3.1

7.8CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS

0.3% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-25)

CWE

CWE-61

Published

2025-12-03

Modified

2026-10-18

Record from

the NVD, synced 2026-10-19

References

• https://docs.plesk.com/release-notes/obsidian/change-log/#plesk-18074
• https://docs.plesk.com/release-notes/obsidian/whats-new/
• https://support.plesk.com/hc/en-us/articles/36494997377687--CVE-2025-66431-Security-vulnerability-in-domain-creation-mechanism-allows-Plesk-users-to-execute-arbitrary-code-on-behalf-of-root

Check your stackJSON