# Plesk Site Import: CVE-2026-107246 – what should you do? > Plesk Site Import: CVE-2026-107246 is critical. Check affected versions, the update to 1.13.2 or newer and the right request to send to your hosting provider. - Quelle: https://bezahlbare-webseite.de/en/ratgeber/plesk-site-import-luecke-was-tun/ - Datum: 2026-11-10 - Sprache: en - Thema: Technik & Sicherheit As of 10.11.2026: The CVE-2026-107246 vulnerability in Plesk Site Import can allow third-party code to be executed with root privileges, which means extensive privileges on the hosting server. Extension versions up to and including 1.13.1 are affected. Plesk recommends updating to 1.13.2 or newer. Have someone check promptly whether Site Import is installed on the server hosting your website and which version is installed. If you use Shared Hosting, ask your hosting provider to carry out this check. ## What happened with Plesk Site Import? Plesk has issued a warning about a vulnerability in the Site Import extension. Domain and session identifiers are not checked sufficiently. This allows what is known as Path Traversal: an internal session with elevated privileges can be redirected to a directory controlled by the attacker. According to the CVE description, this can result in code execution as root. This vulnerability is not in WordPress, Joomla, Shopware or TYPO3. It affects the Plesk extension on the hosting server. If attackers successfully take control of this server, the websites hosted on it may be affected indirectly. Plesk warns of possible effects on all Subscriptions hosted there, meaning hosting subscriptions. Website operators should therefore ask about it even if they have never started an import themselves. ## How dangerous is CVE-2026-107246 in practice? The security rating in the official CVE record is CVSS v4.0: 9.2 – critical. The possibility of code execution with root privileges makes a prompt check and update necessary. However, this rating does not prove that your server has been breached. There is an unresolved discrepancy regarding the conditions required for an attack: the description refers to a Subscription user without an owner role, while Plesk refers to a user without administrator privileges. At the same time, the CVSS vector includes PR:N. Under the scoring standard, this generally means that no login is required before the attack. This is not the same as lacking administrator privileges. The sources do not resolve this contradiction. Neither an anonymous attack path nor a mandatory login requirement has therefore been sufficiently confirmed. The specific attack conditions meant by the AT:P identifier also remain unclear. As of the research date 10.11.2026, active exploitation, observed attack attempts and a public PoC as technical proof of feasibility have not been confirmed. The identifier is not included in the reviewed CISA KEV catalogue dated 09.11.2026; later additions cannot be ruled out. This lack of evidence is not an all-clear and does not prove that no attacks are taking place. Do not wait for a report of an attack before checking the version. ## Which versions are affected, and which update helps? Site Import up to and including version 1.13.1 is affected. According to the vendor changelog, the corrected version 1.13.2 was released on 04.11.2026. The vendor advisory was updated on 09.11.2026; the official CVE record was published on 10.11.2026. Plesk recommends 1.13.2 or newer. This version threshold indicates the fix for this specific vulnerability and is not a general security guarantee for the server. The version of the extension is what matters. An updated Plesk panel alone does not confirm its patch status. The product catalogue lists Plesk 18.0.60 as a requirement for Site Import 1.13.2. If there are problems with the update, ask the administrator to check compatibility as well. The reviewed vendor and CVE information does not explicitly distinguish between Linux and Windows for this CVE. In particular, the term root cannot be taken as confirmed assurance that Windows is not affected. ## How can I check whether my hosting is affected? With a Shared Hosting customer account that has no administrator privileges, you cannot patch the server-wide extension yourself. Extension management is reserved for Plesk administrators. If you do not have this access, send the request to your hosting provider below. Enabled automatic updates do not replace checking the version that is actually installed. For administrators, the Plesk CLI reference for Linux documents the command `plesk bin extension --list` for taking an inventory. The administration guide shows identifiers and names for this purpose, but no version output. The research did not find a directly documented CLI command for checking the installed Site Import version. Use the administration interface instead: - As an administrator, open Extensions → My Extensions → Site Import and check the version shown. - If the version is up to and including 1.13.1: Open Extensions → Update/Updates, use Check Now to search for updates, select Site Import and run Update. - Then open Extensions → My Extensions → Site Import again. Check whether 1.13.2 or newer is actually installed, and record the version and the time of the check. ## What should I write to my hosting provider? Send this request to hosting support and replace the placeholders. If your website support provider contacts them on your behalf, ask them to forward the specific response from the server operator. Subject: Check of Plesk Site Import / CVE-2026-107246. Hello, please check the hosting server for my domains [DOMAINS], customer number [NUMMER], with regard to CVE-2026-107246. Is Site Import installed and enabled? Which extension version is currently installed? Please confirm the actual patch status and the time of the update to version 1.13.2 or newer, as recommended by Plesk. Have you checked the server for suspicious activity or a possible compromise? What period does the check cover, and does it indicate that I need to take any action for my websites or access credentials? If the update is still pending, please provide a specific update date and details of the interim measures. Thank you. The request does not assume that a breach has already occurred. Its purpose is to clarify the status that applies to your domains and whether further measures are necessary. If you receive a general response, ask for the extension version that is actually installed. ## What should I do if the update cannot be installed immediately? Plesk names the update as the remedy. No official alternative measure is documented in the advisory. Ask the hosting provider to clarify what is preventing the update and to provide a specific date. If the extension is not needed, the administrator can consider disabling or removing it as a possible way to reduce the risk: Extensions → My Extensions → Site Import → Disable or Remove. These administration functions are documented. However, their effectiveness as a complete substitute for a patch for CVE-2026-107246 has not been confirmed. Therefore, do not treat this action as a proven fix for the vulnerability. Ask the hosting provider for a specific description of the interim measures. After the update, ask them to confirm the extension version that is actually installed. The objective remains a confirmed status of 1.13.2 or newer. ## Frequently asked questions about Plesk Site Import and CVE-2026-107246 ### WordPress and plugins are up to date – is that enough? No. This vulnerability affects the Plesk Site Import extension. Current WordPress and plugin versions do not confirm its patch status. Also ask your hosting provider to check the extension version. If a hosting server is compromised, your WordPress website may also be affected indirectly. ### Cloudflare – am I safe? The available research does not demonstrate that Cloudflare protects against this specific vulnerability. No assurance of protection can be derived from it. Even if you use Cloudflare, ask the server operator to confirm Site Import 1.13.2 or newer. ### Static website – does this affect me? A static website may also be affected indirectly if its hosting server is compromised through Site Import. The relevant factor here is the affected extension on the server. Have its installation and version status checked even if your website does not use a CMS such as WordPress. ### How can I recognise a breach? No official indicators specific to this CVE for identifying a breach were found in the reviewed publications. They do not provide a basis for a reliable self-check using particular file names or log signatures. Ask your hosting provider to check for suspicious activity, state the period examined and, where necessary, specify the steps required for your websites or access credentials. ### Do I need Plesk administrator access? Administrator privileges are required to manage and update the extension across the server. As a Shared Hosting customer without these privileges, you cannot install the patch yourself. You do not need to obtain administrator access for this: ask your hosting provider to carry out the check and confirm the result. ### Is Site Import installed automatically? A general default installation has not been confirmed. The import guide requires users to make sure it is installed before use. There is also no evidence that the extension is installed only when it is actually used. The fact that you have never carried out an import therefore does not replace an inventory check. --- Veröffentlicht von bezahlbare-webseite.de — Website im Abo ab 79 €/Monat. https://bezahlbare-webseite.de/