Back to Security Advisories

Vulnerability CVE-2026-107246 in Plesk’s Site Import extension

CVE-2026-107246 affects Plesk's Site Import extension: versions 1.13.1 and earlier are vulnerable, with the fix shipped in Site Import 1.13.2. Update the extension via the Plesk GUI (Extensions → check for updates) or the command line: plesk bin extension --update site-import.

Critical 9.2 CVSS
Plesk

Default Update CMD

plesk installer --select-release-current --update-installed

What this means under a SharedLicense license

The Site Import extension pulls and parses external websites — flaws there are reachable by pointing the importer at a crafted source, giving an authenticated Plesk user a code-execution path on the server.

Situation

A security vulnerability was discovered in Plesk‘s Site Import extension. This security vulnerability has been identified as CVE-2026-107246.

Affected product version

Product / Component Affected versions Patched versions
Site Import extension 1.13.1 and earlier 1.13.2

Impact

Arbitrary code execution as the root user is possible. A Plesk user without administrative privileges may be able to run commands on the server, which can compromise the whole server and all subscriptions hosted on it.

Call to action

Update the Site Import extension to version 1.13.2 or later. See How to manage Plesk extensions (install, disable, remove, update) for the update steps.

How to confirm the patched version is installed

Go to Extensions > My Extensions and check the version shown for the Site Import extension. It should be 1.13.2 or later.

Acknowledgement

We would like to thank Ady Elouej for responsibly disclosing this vulnerability and working with us to help protect our customers.

Frequently Asked Questions

What is CVE-2026-107246?
It is a vulnerability in Plesk's Site Import extension affecting versions 1.13.1 and earlier, fixed in Site Import 1.13.2. The erratum does not name the exact flaw class in its summary — treat the update as security-critical and check Plesk's advisory for the full detail.
Who is affected?
Plesk servers with the Site Import extension installed at version 1.13.1 or earlier — the extension is commonly installed wherever the site-import feature is used.
How do I apply the fix?
Update via the Plesk GUI (Extensions → Updates) or run plesk bin extension --update site-import. Verify the extension version reports 1.13.2 afterwards.
Is the Site Import extension exposed by default?
It runs behind authenticated Plesk access, so exploitation requires a valid Plesk session — still a real risk on shared servers where customers have panel access, which is why Plesk ships the fix proactively.

References

Security Advisories

Related Advisories

Security: phpMyAdmin 5.2.3 WebAuthn Two-Factor Authentication Bypass

2026-10-28

Vulnerability CVE-2026-113386: IMAP command injection in Roundcube in Plesk

2026-10-20

Vulnerability CVE-2026-107663 in WP Toolkit on cPanel & WHM

2026-10-13

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System