{"id":"CVE-2025-66430","title":"Plesk 18.0 has Incorrect Access Control.","summary":"Plesk 18.0 has Incorrect Access Control.","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-284"],"vendor":"plesk","product":"plesk","affected":["plesk >= 18.0.70, < 18.0.73.5","plesk >= 18.0.74, < 18.0.74.2"],"patched":["plesk 18.0.74.2"],"published":"2025-12-12","updated":"2026-10-14","sourceUpdated":"2026-10-14T17:10:00.210","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-66430","references":[{"url":"https://docs.plesk.com/release-notes/obsidian/whats-new/","label":"cve@mitre.org"},{"url":"https://support.plesk.com/hc/en-us/articles/36261922405015--CVE-2025-66430-Security-vulnerability-in-Password-Protected-Directories-allows-Plesk-users-to-gain-root-level-access-to-a-Plesk-server","label":"cve@mitre.org"}],"tags":["nvd"],"epss":0.00551,"epssPercentile":0.44722,"ingestedAt":"2026-10-14T17:44:53.605Z","slug":"CVE-2025-66430","body":"## Overview\n\nPlesk 18.0 has Incorrect Access Control.\n\n## Affected\n\n- `plesk >= 18.0.70, < 18.0.73.5`\n- `plesk >= 18.0.74, < 18.0.74.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `plesk 18.0.74.2`","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}